Yes. A security defect should be logged as a confidential or restricted ticket until a fix has shipped, because an open ticket describing a working exploit is a public how-to. Keep the details private, share them with the people who need them, and open a sanitized public record later.
What "confidential" means in practice
Using GitLab as the example, its documentation says confidential issues are visible only to project members with sufficient permissions, and that they help keep security vulnerabilities private or prevent sensitive information from leaking. Planner, Reporter, Developer, Maintainer and Owner roles can access them. Guests lose access once an issue becomes confidential, even if they commented earlier, although a guest can still see one they created or one assigned to them.
Other trackers have similar features under names like restricted, private or security level. Check how yours works, and check who is actually in the allowed group. A confidential ticket visible to everyone in the company is only slightly better than a public one.
Mechanics worth knowing
From the GitLab documentation:
- For a new issue, tick the confidentiality checkbox before creating it.
- For an existing issue, use the issue actions menu, or the
/confidentialquick action. You need the Planner role or higher. - Child tasks must be made confidential first, because a confidential issue can only have confidential children.
- Each change to confidentiality is recorded as a system note.
- A merge request cannot be made confidential, even in a public project.
That last point surprises people. If you push a fix as a normal merge request on a public project, the diff itself may reveal the flaw. Plan how fixes are developed before you need to, for example in a private fork or a private branch workflow your platform offers.
What to put in the ticket
| Include | Leave out |
|---|---|
| Affected area and version | Real customer data |
| Minimal reproduction steps | Working exploit scripts shared widely |
| Impact in one sentence | Guesses about who exploited it |
| Suggested severity with reasoning | Live credentials or tokens |
| Owner and next step | Speculation in public channels |
Process in five steps
- Tester files the ticket as confidential from the start, not after someone notices.
- Security reviews severity and decides who needs access.
- Developers fix on a private path and add a regression test.
- QA verifies the fix against the original steps.
- After release, write a sanitized summary for the changelog or advisory, and decide when to lift confidentiality.
Mistakes to avoid
Discussing the bug in a chat channel with a hundred members. The ticket may be private while the chat is not.
Attaching screenshots with live data. Redact them, or use test accounts.
Forgetting linked tickets. A public epic that links to a private issue can leak its title if the title is descriptive. Use neutral titles such as "Authorization check on export endpoint".
Leaving the ticket private forever. Once fixed and disclosed as appropriate, record the outcome so the history is useful for audits.
When the bug is in someone else's software
If a tester finds a flaw in a third party library or product, report it through that vendor's published channel rather than your own tracker, and keep a private internal ticket tracking your exposure and workaround.
Try it yourself
Click through it at your own pace, or open it full screen. Follow one finding from discovery to closure and note the points where a private ticket would carry the details.
Safeguard's compliance and evidence automation can help record how findings were handled over time. A free scan is a quick way to see dependency findings for your own project.
Quick check
Can anyone on the team see a confidential ticket?
No. In GitLab, only project members with sufficient roles can, plus the creator and assignee in some cases. Review the group regularly.
Is a private ticket enough on its own?
No. Fixes, chat messages and linked items can still leak details, so handle those privately as well.
Sources
Last reviewed: 19 October 2026.
