IMHO, it's a big issue, or I missed something…
It seems anybody is able to access a preview content URL (something like http://<user>.<projet>.www–sandbox.<alfresco-virtual-domain>:8081)
e.g.: That means HR content could be accessible to other department employees, even before content submission to the staging sandbox; even more: this content could be documents with HR limited access! So people would be able to read drafts, but not the published version…
I can not believe this is a real issue: I must have missed something…