Publish to web clarification

MaxW The major risk around Publish to Web is with the private company information being exposed to people who shouldn't see it. The URL's generated are not secured, so they are discoverable. In your case, your ultimate use case is external public sites, so it sounds like you just want to validate prior to publishing in the site itself. - valid use case.

To address some of the other questions:

MSFT using it: They haven't yet, but it is certianly a possibility. In that likelyhood, I would assume if you deleted the publish to web link that it would come off any published site.

Discoverability: When the feature was first released we would search portions of the generated URL's and actually get quite a few results simply by search engine. Talking to my security guys, they walked me through several ways in which it apparently wouldn't be that hard to build programs to search for valid links based on the URL strings generated. How someone goes about doing that, I have no idea) But as I mentioned. The danger is around some entity discovering company private information.

A publish to web finder tool: Uh, no.

My stance is based on an abundance of caution, and heeding explicit warnings. In my eyes, it is all about the data exposed. My recommendations are strong because the improper use of this feature could very well land people in a lot of hot water in their workplace if they don't understand the implications. (Company data security policies)