Issue Security and Sprint Planning. Safe together?

Casey Meijer

I'm trying to find out how Issue Security and Sprint Planning interact and whether it is "safe" to give the Sprint Planner permission to view "security-critical" issues. 

 

The obvious issue is that, during planning, the Scrum Master will have their account open for all team members to view, thus exposing "security-critical" issues to the entire team...

 

Can this be avoided while still allowing the Scrum Master to lead Sprint Planning from their account?

Casey Meijer

Figured it out. 

 

Edit the JQL Query for the Agile Board to exclude Restricted Issues:

 

...AND (NOT Level = Restricted OR Level is EMPTY)...

 

It would be good to note this somewhere in the "Issue Security" documentation, if it isn't already there.