After going online with the customer we identified that the security issue was caused by a 3rd party solution (custom fields) and not by QWP.
RE: Permissions for QWP's users.
After going online with the customer we identified that the security issue was caused by a 3rd party solution (custom fields) and not by QWP.