Why does GMail appear on my phone without unlocking? If I use GMail and then lock my phone, when I switch it back on, GMail is usable before the PIN has been entered. I can use it entirely as normal but for the absence of the show all apps button at the bottom of the screen, and pressing home takes me to my lock screen.

This is obviously a massive security hole! Is there an option somewhere that I've missed to enable this functionality?

I'm using a rooted Nexus 5 with The Xposed framework and GravityBox.
I am also using the App Settings extension, and 'Show when locked' was enabled. D'oh. I don't think I did this, but might have done whilst experimenting with my new phone!

Thanks @Chahk1 for the helpful comment which gave me a hint on where to look. :)