If you give the url of the photo you are allowed to see to someone else, you can give the actual photo as well. I don't get the security risk here.