Hi Brad,
You’re absolutely right on both issues.
Thanks for letting me know. Look for 2.39.1 later today with a patch.
On the draft posts: the mashups now use AJAX to query the database. WordPress treats front-end AJAX calls as though they came from admin screens. Apparently in the WP query code there is a hard-coded check that adds all statuses if the query is coming from the admin – and since WP can’t tell the query is really from the front-end, it returns all posts.
There is a 3-year-old ticket about this that seems to have been resurrected again recently:
http://core.trac.wordpress.org/ticket/12400
Maybe they’ll fix it this time. Meanwhile, I’ll update the query code to default to ‘publish’. I don’t see the is_admin() check doing anything else so that should fix the problem.
As for the posts_per_page – I switched it to support paging the results, but since that function didn’t make it into this release, I’ll set it back to -1 by default.
Thanks again, please let me know if you notice any other issues.