My company uses SharePoint for their public website by allowing anonymous access. Some of our lists and document libraries have permissions to only allow certain users to be able to access them. I'm not sure exactly what our site's configuration is, but we do only have one site.
I recently discovered that despite these permissions, all of our content is anonymously and publicly available through web services. I created a small javascript soap/ajax web services script that retrieves all list content. To be fair, I've tested this as well on other SharePoint sites and am able to retrieve much of their list/document data.
Is there a way we should be extending the list/library permissions to web services, or restricting web services access? Or, is the best practice to create multiple sites - a public and private version?