Q:

RemoteAction not respecting sharing settings

I have a RemoteAction in my code that queries data.  I receive all the records irrespective of the fact that with sharing has been used for the containing class. 
Does RemoteAction NOT respect sharing settings? 
I read the documentations here and here.  and my Controller version is 36.0.  but still not pretty sure. 

A:

I was only able to reproduce the behavior you describe by changing the controller to without sharing.  Regardless, this workaround should let you filter out records which should not be viewable:
@RemoteAction
public static List<MyObject__c> getRecords()
{
    Map<Id, MyObject__c> records = new Map<Id, MyObject__c>([
        SELECT Name FROM MyObject__c
    ]);

    List<MyObject__c> viewable = new List<MyObject__c>();
    for (UserRecordAccess access : [
        SELECT RecordId FROM UserRecordAccess
        WHERE UserId = :UserInfo.getUserId()
        AND HasReadAccess = true
        AND RecordId IN :records.keySet()
    ]) viewable.add(records.get(access. RecordId));
    return viewable;
}

