Are redeemScripts private?
You can treat the redeemScript as the public key. The redeemScript, like the public key, is revealed entirely when you spend from your multisig address. So it will become public information, much like your public key will also become public information when it is used in an input.

The redeemScript cannot really be used to do anything particularly bad unless the redeemScript has certain conditions which allows someone to do so. For multisig, there are no such conditions. Having the redeemScript only allows you to see what the specific conditions for spending an output are, and that information by itself is not useful.