I have client users that only have permissions to certain projects (as you would expect) When logging in as one of them today, I found that the auto-complete dropdown box that appears when entering a search value in the top-right search field includes matches to issues/projects that this user doesn't have access to see.
When you actually click enter on that search, it loads the search results page and correctly only shows issues they have access to.
Permissions helper is not helping me identify the root cause of the issue.