The first is treating privacy as a switch. A private community is private because of several small decisions: closed registration, a logged-out view that shows nothing, spaces with the right visibility and members who understand the rules. Check each one with a test account instead of trusting a single setting.
The second is inviting too many people too soon. A private community depends on its first conversations. If you invite a large group at once and nobody posts, the quiet will put people off. Invite a small founding group, give some of them a job, and widen the circle when the feed has its own life. Members who join later should find people already talking.
The third is hiding the reason to join. A closed door needs a clear sign on it. Your public landing page should say who the community is for, what members do there and how to ask for an invitation, in a few short lines. Finally, remember that private does not mean unmoderated. Members share more when they trust the room, and that trust depends on you acting when something goes wrong.