Examples:

• forum - do not mail users when not in any group; review displaying in user activity report
• assignment - do not display nonmembers when grading
• blocks - add checks before displaying recent activity, etc.
• calendar - filter events from not accessible activities

We should do the security review at the same time too - we might be leaking some info from hidden/inaccessible/separate groups etc.

The problems are only in activities where students submit content - passive resources should be just fine.