We were trying to promote a bundle of our SME from Test to Prod environment after hours and ran into a failure (twice). We ran out of time to perform a successful migration so were intending to leave the SME migration for the next after hours time. We received reports that users could see more data and reports than expected. We investigated and discovered that while the SME rolled back to an archived version, all security customizations became unpublished and entered new state. I'm surprised that Security features did not rollback to their last working state as well. This feels like a bug, but I'm told in my SR that this would be an enhancement. I'd recommend either giving users a way in prod to manually re-publish security features or have the system automatically rollback to the last working security as it does the SME.