Even if a user is restricted to only one project

It is possible to gain access to issue description and other data by using the activity stream gadget.

see attached screenshoot,

url /browse/?jql= is conforming to security level by only showing issue in the demo project

gadget Activity Stream do not conforme to security level and show full description and comment from other project