Google Spreadsheet gotcha: beware open editing

I don't think this is obvious, so I'll toss out a warning.

Google Spreadsheets can be shared for viewing (only) at the worksheet (tab) level. This is an advanced option after you click on the share button.

That's fine, but there's a trick here.

The Spreadsheet security model applies to the spreadsheet, not the worksheet. So if you have standard account-limited editing sharing the worksheet behaves as expected.

The catch comes if you enable the new "anyone can edit" option. This works when you can keep the URL a secret.

If you're sharing a worksheet, however, you're exposing the URL.

The combination of sharing a worksheet and open editing means anyone viewing the worksheet will be able to edit the entire spreadsheet if they click on the 'edit if you have privileges' link.

Google should make the security and sharing models both worksheet specific. Until then, be careful!