A user who is not a member of a Project's team has the ability to start a task on that project.

[Collab01]

On public projects, a user who is not a declared team member of a project can interact with that project with what seems to be the same permissions as a team member. Specifically, the random user can start tasks on the workbench and abandon them. It seems adding a task would be possible. Other functionality has not been tested.

This would seem to be a bug.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.