Exclude Code/Credentials in e-mails

[Valentin Peralta]

Hello,

What is the best way to hide/exclude sensitive information from JIRA emails (ticket updates, etc)? It's a security liability to include stuff like keys, code, passwords, etc. on emails; but I don't know what can be done to avoid this issue without disabling email notifications.

[Nic Brough -Adaptavist-]

There's no code for doing that in Jira, because there's no way to tell it information is sensitive (other than to use simple security to protect the entire issue)

You're looking at the wrong part of the problem though.  There is no real technical solution, and if your people are putting sensitive information into Jira, you have to assume it's compromised already.

The real solution is to get your people to stop publishing it in Jira.  You actually have a security issue here, and it needs to be fixed by prevention, not "closing the door after the horse has bolted"

[Payne]

Our organization had a small problem with help desk staff putting passwords in issues, and we resolved it exactly as you state, simply by user education. Not only should information like that not go out in emails, the topic of the original poster's question, but further, it should not be in Jira, period, where many more eyes than are necessary have access to that information.