I have just shared a JPD space with an external user as a test. They setup there Atlassian login using https://id.atlassian.com/ which was all good. I then added them as a contributor via the Share option. They got the email and then could see the space.
However, they can also see all other spaces that we have setup in Jira and they even have access to app like our timesheet app and can see the developers timesheets.
Why is this happening and what I can do to prevent it. I just want the external user to be a contributor on the single space.