We have an issue in our JIRA where a fairly large number of issues were created that had information about projects in our operational deployments. These deployments are covered by HIPAA privacy rules, which means we need to have any specific information in a project that's not publicly accessible.
Going forward this is easy: we have a project specific to our operational deployment that isn't publicly accessible. Any issues in our platform code that need to reference information about an operational deployment gets two issues: one describing the problem in a generic way in the publicly accessible project and one with the data particular to our operational deployment in the non-accessible project.
The problem we have is our existing issues for operational deployments in the publicly accessible repo. We can modify the publicly accessible issues to remove the sensitive data and create new non-accessible issues, so that we're just creating the same scheme we want to use for new issues. The problem is that all of the sensitive data remains in the publicly accessible issue through the history tab, rendering the whole exercise moot for existing issues.
Going forward, there are only two options I can see:
- Make the issues in the publicly accessible repo with sensitive information inaccessible to users outside of our development group (this is probably not great, given that it relies on people not later on unhiding the issues)
- Hide or modify issue history in our publicly accessible repo so that either any sensitive info can't be seen by people who don't have the appropriate permissions or that the sensitive info is actually just removed by having edited or removed the relevant chunks of issue history
Any help on this would be greatly appreciated. It's a critical issue for us in terms of getting our repository suitable for public access.
