This is by design in the security model for the ArcGIS platform. Applications using appId/appSecret by design don't have permission to search for private content, even if owned by the same person.
Contact Esri Support or post on the ArcGIS forums. If you think you've found a bug, report it as an issue and include specific steps to reproduce, the observed and expected behavior.
Esri welcomes contributions from anyone and everyone. Please see our general guidelines for contributing.