I have created a Windows Application, which uses Client object model to access lists in a Sharepoint site(installed and configured on a separate server).

I have used the default credentials to access the site i.e. it uses the client's system login credentials(From where it is running) to access the Sharepoint site. Now I have the permission to access the site and therefore the application successfully retrieves the SP Lists and Libraries.

I have generated an exe file and distributed the same to another user, who is not having access the Sharepoint site. I am amazed to find the application still retrieves the SP Lists and Libraries, though it is running in a client's system who is not having the access.

Can anybody let me know what is issue, as I have been expecting an access denied message for the client who is not having the access to Sharepoint site.