I have read around on this but see conflicting views, so seek help here.
I have a published Google Sheet containing some mildly sensitive data. I use PHP to access the content, then present specific sections to different people in a members only web page. Assuming I never hyperlink to the published sheet:
Does the published sheet get indexed by Google?
Can a user deduce through headers, or by other means of measuring traffic, what the full URL of the Published Google Sheet?
PHP runs on server side (in case of App Engine a Google Server).
When you request data from a spreadsheet from your server a user would have to listen in on the traffic between your server and the spreadsheets server. Since you use App Engine both servers are Google servers making it really difficult to listen in on this communication. So unless you put the URL to your sheet somewhere outside your <?php ?>
tags there is no way someone (that includes search index crawlers) can deduct the original URL of your spreadsheet.
However: Since you show data from your spreadsheet on your web page a search indexer can index that data, thus indirectly indexing the spreadsheet. If someone carelessly shared the URL to your spreadsheet and the indexer finds that URL as well it could be possible to tell that data on your website comes from that sheet.