Should this also check category access settings here? We've got an open security report that posts in private categories sometimes show in search; this might be an ideal place to check that.

Yup, looks like just the place to do so - will update once I am done with basic test coverage for the helper (want to make sure there are no other surprises first)

Or actually sooner than that as properly testing the :category qualifier requires the check to work correctly.

After reading through the security report itself, I realized that it doesn't seem to be related to search, @ArtOfCode-, am I missing something? I abstracted the check for category access into accessible_categories_for just in case, but the tests show that search handles category access correctly.

That's a different report - there's another one open in the support tickets that hasn't made it to a GH advisory yet.

Ah, got it, there is another one. Hmm, looks like that one might crop up when there is no filter by category. Will take a look