nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How can you prevent a reply to an internal comment from becoming public?

Clemens Kleibusch

Hi all,
In Jira Cloud, it is possible to reply to a ticket via email. If I write an internal comment using an @mention and the recipient replies via email, the reply to the internal comment is treated as a public comment in Jira Service Management.
That shouldn’t be the case! I would regard that as a genuine security vulnerability.
Can I stop that from happening?
Thanks for any help!

Accepted answers

Arkadiusz Wroblewski

Hello @Clemens Kleibusch

I do not think there is a native way to fully prevent this in JSM Cloud today.

If someone replies by email, that reply is treated as customer-facing communication, so I would not rely on @mentions in internal comments for sensitive discussion.

The practical solution Today are to keep that collaboration inside Jira only, move it outside the ticket, or use automation as a workaround to switch those comments back to internal. Atlassian already has an open feature request in this area.

https://jira.atlassian.com/browse/JSDCLOUD-3499

PS: Take a look on this App https://marketplace.atlassian.com/apps/1220666/jira-cloud-for-outlook-official

All comments

Arkadiusz Wroblewski

Hello @Clemens Kleibusch

I do not think there is a native way to fully prevent this in JSM Cloud today.

If someone replies by email, that reply is treated as customer-facing communication, so I would not rely on @mentions in internal comments for sensitive discussion.

https://jira.atlassian.com/browse/JSDCLOUD-3499

PS: Take a look on this App https://marketplace.atlassian.com/apps/1220666/jira-cloud-for-outlook-official

Clemens Kleibusch

Hello @Arkadiusz Wroblewski

Thank you for your answer and the link to the ticket.

The workaround in the issue is easy to implement and at least I can use it to correct the incorrect permissions. But of course I can’t remove the notifications sent to customers, because that’s the most important piece of information for them – that they’ve received a reply!
Well, the ticket is only 10 years old, so I don’t want to be impatient...

Clemens Kleibusch

Hello again,

It seems impossible to me to identify the comments in question. I couldn’t find anything that marked the comment as ‘sent by email’. Because those are the only comments I want to make internal, provided a suitable role can be found for the sender.

Arkadiusz Wroblewski

@Clemens Kleibusch

One important caveat for this workaround though: this only changes the comment visibility in Jira afterwards. It does not undo any customer notification that may already have been sent.

For that to work Stable and on Confident level will be needed from you to rely probably on some external Apps/Mailhändler

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira-service-management

permissions

internal-comments