Also considering the sibling story, at least the server-side preview builder is definitely entirely unauthenticated to every possible service. A preview builder

Also considering the sibling story, at least the server-side preview builder is definitely entirely unauthenticated to every possible service. A preview builder running on the client side might conceivably pick up your authentication to something in various circumstances.