When using evince as preview application for Gtk+-2.10, the input file will be in the temp folder.  When evince is closed, this file is not erased.  This is a *critical* security risk.

As an example, consider an email client (MUA) which decrypts a PGP encrypted message.  It now uses evince to preview the message printout.  When the MUA is terminated, the user will of course assume that none of h(is|er) confidential data is leaked, but there is still a pretty formatted file in the temp folder, readable for root.

Therefore, in preview mode, evince *must* at least erase the file from the temp folder.  It might be a good idea to safely erase the contents (as e.g. shred(1) does, or using a more secure algorithm).  This is effectual on non-journaled file systems only, though.