Hide Custom Actions on Permalink

I've noticed that if I provide a permalink that does not require a sign-in, people viewing the permalink can still see the custom action drop-down menu (when custom actions are present) and the custom action button if it is visible in the view.

If a non-logged-in user selects a record and uses the custom action drop-down menu it actually carries out the action!

I cannot find an option to hide the custom actions. If these cannot be hidden, it seems like a real bug and security issue.

Please let me know if this can be fixed soon.

Thank you,

Mike