TL;DR

For more info: https://www.bookstackapp.com/docs/user/content-overview/
And: https://demo.bookstackapp.com/books/bookstack-demo-site/chapter/content-examples

Embedded images are public and accessible by anyone (e.g. by direct link) 
Attachments are served by bookstack, access is defined by parent page permissions. 
If the user can see the page then they can download the attachment.
Shelf permissions do not cascade to books, since a book can be in multiple shelves.

Deleted pages are placed in a Recycle Bin and can be restored after a query to @Admin

Revisions are fully visible by anyone with access to page (e.g. public users)
If a revision was made to occlude information, please remember to clear the revision history. Eventually

Pages published are visible immediately - Hold the page in Draft form until you are ready to display it.
There is no similar option for Books or Chapters. Eventually

Website timestamps are in PST