One of the users of my site noticed that their content profile nodes were showing up in google queries for his name. While content_profile restricts access to profiles via the user page, it does not restrict access via the node alias (users/bitchkat/profile) or node/%node url (node/78)

I fixed this in one of my custom modules as follows

function league_manager_menu_alter(&$items) {
    if ($items['node/%node']['access callback'] !== TRUE) {
        $items['node/%node']['access callback'] = 'lms_node_access';
    }
}

function lms_node_access($op, $node, $account=null)
{
    if (is_null($account)) {
        global $user;
        $account = $user;
    }

    // content profile isn't blocking content_profile nodes
    if ($op == 'view' && is_content_profile($node->type)) {
        return ($account->uid == $node->uid)
            || user_access("access user profiles");
    }
  
  // fall back to regular node access rules
    return node_access($op, $node, $account);
}