After generating a shared link with view-only access for a doc/video if the user opens the link in the browser to view it, the whole content is still available even after shared link has expired. More surprisingly while viewing there is absolutely no checks made to the Box.com APIs by the browser. Therefore the shared link content is available even if there is no network connection. Of course if user refreshes the browser then it fails.

This is surprising as whole content (doc or video file) is downloaded by the browser.  Isn't it possible that a hacker can find this content ?

I tested with a a 10MB  size file so not sure what is the behavior when file is very large.