Unpublished projects is being picked up by the API

Projects marked as unpublished are unexpectedly being returned in API responses where only published/public projects are intended to be listed.

I noticed the issue because 2 projects (a published one and an unpublished one) had the same Project ID and the older project got picked up by the API.

The API should simply ignore unpublished projects.