How do I remove the ability for logged out users to see tickets, comment as anonymous?

Question

People who are not logged in can see and comment as anonymous on tickets.  This is a big security risk for us and our clients.  I only want access for logged in users.

I tried in both Safari and an incognito window in Chrome and I am able to see the full ticket without being logged in.

Nic Brough -Adaptavist- · Answer

If you can then see the issue without any login, the next step is to be 100% sure there is no "anyone" in the permissions for that one project, then visit https://support.atlassian.com to raise the issue with them.

It sounds very broken to me, and quite a security hole, so I'd expect quite a swift response.

Nic Brough -Adaptavist- · Answer

Completely understand, but I don't share emails in public (so much spam already).  Could you try it with a clean browser?  If you've got Chrome or Firefox, there's an "anonymous browse" option which will not carry any login details even if you've got a normal session running - that's more than good enough to do this test.

Leslie Kramer · Answer

Putting a link here means everyone will have access to all of our projects so even if it's a dummy project, I'd rather not post a link here.  Do you have an email I can use?