This is more of a webservice / access control problem than anything SPARQL related. However, since SPARQL endpoints are supposed to be created as per the SPARQL spec, i think this a valid question, as I'm sure people will encounter it again in the future.
So, to answer your question, "public" usually means that certain headers are set in order to allow a request to hit the endpoint when it is not coming from the same domain. From there, you can specifically allow certain types of interactions with the endpoint. If you wanted to kinda just allow everything, you could set the following headers:
'Access-Control-Allow-Origin: *'
"Access-Control-Allow-Credentials: true"
'Access-Control-Allow-Headers: X-Requested-With'
'Access-Control-Allow-Headers: Content-Type'
'Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE //http://stackoverflow.com/a/7605119/578667
'Access-Control-Max-Age: 86400'
Depending on how you built the endpoint, it'll either have some settings somewhere where you can adjust the headers, or, you'll have find the headers settings for the application framework itself if you're using one. But, in general, the above headers would make it "public"