Sharing Showcase Portfolio Outside Organization

[dtowers]

Started testing the new Portfolio today. Our K-12 district is new to Canvas and never implemented a portfolio solution.

I was testing the share as a studnet using the 'Anyone can view link' to an outside user = does not have a login ID for our instance of Canvas. As the outside user, I am able to open and read the student's portfolio. I can select and download evidence. An error is received but does not stop me from viewing or downloading the evidence. It seems evidence from a course assignment is now available to an outside user.

Is this expected behavior or a a new tool bug?

If our studnets are able to share outside the organization, that may be a factor that forces us to disable the tool altogether. 

Thanks to anyone that has any insight on the studnet sharing experience.