BuddyPress.org

After some test with the latest version of WP and BP I have found a slight bug with using multiple scopes in the activity-loop.php. Below is the code I used in the loop:

<?php if ( bp_has_activities( bp_ajax_querystring( 'activity' ) . '&scope=just-me,friends' ) ) : ?>

The reason I say it is a slight bug is because I found if you go to dashoard/settings/buddypress/settings and then go under activty settings and check activity auto-refresh then even a user you are not friends with will get a notice to load newest and you can briefly see that activity of the user you are not friends with until the page is refreshed, then it goes away.
If you use multiple scopes in the activity-loop.php as I did above in the code example and you go to dashoard/settings/buddypress/settings and then under activty settings and un-check activity auto-refresh then it works as expected and you only will see you and your friends activity in the activity stream. Hopefully there will be a fix but until then just make sure activity auto-refresh is unchecked. I hope this helps debug and helps others that may experience this issue. Thanks!