With security enabled and discovery disabled an unauthenticated user can browse any files in the userContent directory by going to http://server/userContent

This can be a big security risk for those who use the copy_to_slave plugin and store sensitive files in the userContent directory.