is_preview only if you are logged in 

is_preview is true when you access ?_preview=1 .
That means, users who are not logged in, can view non published page. This might cause a leakage of information.
Update front.ctrl.php

Auth::check()
Merge pull request #53 from ounziw/patch-1

"is_preview" is true only when you are logged in