The only leaks I'm aware of is the horrible up/down (and probably down only) staircase one, plus, of course, roofless tiles (built fortifications, obsidianization below an up/down staircase removing the floor, and thus provides a diagonal path). If there are others I'm definitely interested in knowing about them.
Given the subject, there are spoliers below.
There is a safe way to mine the "excess" candy, and that is to note that the hollow center is a 2*2 square, and thus requires a 4*4 pillar, so if you have less than 3 in a row you can mine it (provided, of course, the less than 3 isn't due to your mining...).
Also, each level of the hole is shifted at most one tile in the X and Y direction independently. This means that if you've managed to establish that the (potential) hollow is in a 4*4 pillar, you can safely channel (or dig) two tiles away from that (i.e. outside of a 6*6 rectangle).
The problems with the fortification method is that once you've found a hollow the FPS takes a bit of a hit as the clowns are spawned, and clowns can use range attacks through the fortifications (as well as scare dorfs). Because of this, I shave first and go for the fortification as the last stage.
The only good method I've found to mine the candy in the magma sea is to obsidianize the magma, which means leading running water there. You then find the X*Y box you need to obsidianize by taking the maximum extent of the outcropping "periodized" to the top level in each of the N/W/S/E direction ("periodized" in this case means taking into account that you need an obsidian wall outside of the outcropping, and in doing so you need to be one tile further out on the next sea level above, and in order to do that...
Dealing with the magma flow covering magma is its own mess...
Also, don't repeat my mistake of digging too deep. I probed beneath an outcropping at the first complete SMR layer. That turned out to be the only such layer. My miner died without being able to take a single step, and my defenses were only rudimentary (and the lever pullers were too slow).
Finally, secure the dig site(s) with single tile access corridors blocked by drawbridges (more than one is good), as indicated above. I also use door that I lock behind the miner when I either break intentionally of the fan gets some extra workout. That won't stop them, of course, but buys time for the lazy lever operators to do their job.
I'm partial to menacing spikes on repeat for clown elimination, but there are other methods, such as checkers. After you've dealt with the spawned invasion force, you've only got the standard roamers to deal with, and there is a way to handle them that makes securing the circus completely surprisingly easy (a large amount of work to be sure, but still just work, not much in the way of danger).