debian-mirror-gitlab/doc/user/project/issues/confidential_issues.md

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

108 lines
5.5 KiB
Markdown
Raw Normal View History

2020-06-23 00:09:42 +05:30
---
stage: Plan
group: Project Management
2022-11-25 23:54:43 +05:30
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/product/ux/technical-writing/#assignments
2020-06-23 00:09:42 +05:30
---
2021-09-30 23:02:18 +05:30
# Confidential issues **(FREE)**
2017-08-17 22:00:37 +05:30
2021-09-30 23:02:18 +05:30
Confidential issues are [issues](index.md) visible only to members of a project with
2017-08-17 22:00:37 +05:30
[sufficient permissions](#permissions-and-access-to-confidential-issues).
Confidential issues can be used by open source projects and companies alike to
keep security vulnerabilities private or prevent surprises from leaking out.
2022-04-04 11:22:00 +05:30
## Make an issue confidential
2017-08-17 22:00:37 +05:30
2022-04-04 11:22:00 +05:30
You can make an issue confidential when you create or edit an issue.
2017-08-17 22:00:37 +05:30
When you create a new issue, a checkbox right below the text area is available
2021-04-29 21:17:54 +05:30
to mark the issue as confidential. Check that box and hit the **Create issue**
2017-08-17 22:00:37 +05:30
button to create the issue. For existing issues, edit them, check the
confidential checkbox and hit **Save changes**.
2022-04-04 11:22:00 +05:30
When you create a confidential issue in a project, the project becomes listed in the **Contributed projects** section in your [profile](../../profile/index.md). **Contributed projects** does not show information about the confidential issue; it only shows the project name.
2022-10-11 01:57:18 +05:30
![Creating a new confidential issue](img/confidential_issues_create_v15_4.png)
2017-08-17 22:00:37 +05:30
2022-04-04 11:22:00 +05:30
## Modify issue confidentiality
2017-08-17 22:00:37 +05:30
2018-03-17 18:26:18 +05:30
There are two ways to change an issue's confidentiality.
2021-03-08 18:12:59 +05:30
The first way is to edit the issue and toggle the confidentiality checkbox.
After you save the issue, the confidentiality of the issue is updated.
2018-03-17 18:26:18 +05:30
2022-07-23 23:45:48 +05:30
The second way is to locate the **Confidentiality** section in the sidebar and select
2018-03-17 18:26:18 +05:30
**Edit**. A popup should appear and give you the option to turn on or turn off confidentiality.
| Turn off confidentiality | Turn on confidentiality |
| :-----------: | :----------: |
2022-07-23 23:45:48 +05:30
| ![Turn off confidentiality](img/turn_off_confidentiality_v15_1.png) | ![Turn on confidentiality](img/turn_on_confidentiality_v15_1.png) |
2017-08-17 22:00:37 +05:30
Every change from regular to confidential and vice versa, is indicated by a
2022-10-11 01:57:18 +05:30
system note in the issue's comments:
2017-08-17 22:00:37 +05:30
2022-10-11 01:57:18 +05:30
![Confidential issues system notes](img/confidential_issues_system_notes_v15_4.png)
- **{eye-slash}** The issue is made confidential.
- **{eye}** The issue is made public.
2017-08-17 22:00:37 +05:30
2022-04-04 11:22:00 +05:30
When an issue is made confidential, only users with at least the Reporter role
2022-01-26 12:08:38 +05:30
for the project have access to the issue.
Users with Guest or [Minimal](../../permissions.md#users-with-minimal-access) roles can't access
the issue even if they were actively participating before the change.
2022-04-04 11:22:00 +05:30
## Confidential issue indicators
2017-08-17 22:00:37 +05:30
There are a few things that visually separate a confidential issue from a
2022-10-11 01:57:18 +05:30
regular one. In the issues index page view, you can see the confidential (**{eye-slash}**) icon
2021-10-27 15:23:28 +05:30
next to the issues that are marked as confidential:
2017-08-17 22:00:37 +05:30
![Confidential issues index page](img/confidential_issues_index_page.png)
2021-03-08 18:12:59 +05:30
If you don't have [enough permissions](#permissions-and-access-to-confidential-issues),
you cannot see confidential issues at all.
2017-08-17 22:00:37 +05:30
---
2022-10-11 01:57:18 +05:30
Likewise, while inside the issue, you can see the confidential (**{eye-slash}**) icon right next to
2021-03-08 18:12:59 +05:30
the issue number. There is also an indicator in the comment area that the
2017-08-17 22:00:37 +05:30
issue you are commenting on is confidential.
![Confidential issue page](img/confidential_issues_issue_page.png)
2018-03-17 18:26:18 +05:30
There is also an indicator on the sidebar denoting confidentiality.
| Confidential issue | Not confidential issue |
| :-----------: | :----------: |
| ![Sidebar confidential issue](img/sidebar_confidential_issue.png) | ![Sidebar not confidential issue](img/sidebar_not_confidential_issue.png) |
2021-10-27 15:23:28 +05:30
## Merge requests for confidential issues
2022-04-04 11:22:00 +05:30
Although you can create confidential issues (and make existing issues confidential) in a public project, you cannot make confidential merge requests.
Learn how to create [merge requests for confidential issues](../merge_requests/confidential.md) that prevent leaks of private data.
2021-10-27 15:23:28 +05:30
2017-08-17 22:00:37 +05:30
## Permissions and access to confidential issues
There are two kinds of level access for confidential issues. The general rule
is that confidential issues are visible only to members of a project with at
2022-04-04 11:22:00 +05:30
least the Reporter role. However, a guest user can also create
2017-08-17 22:00:37 +05:30
confidential issues, but can only view the ones that they created themselves.
2022-07-23 23:45:48 +05:30
Users with the Guest role or non-members can also read the confidential issue if they are assigned to the issue.
When a Guest user or non-member is unassigned from a confidential issue,
they can no longer view it.
2017-08-17 22:00:37 +05:30
Confidential issues are also hidden in search results for unprivileged users.
2022-04-04 11:22:00 +05:30
For example, here's what a user with the Maintainer role and the Guest role
2021-09-04 01:27:46 +05:30
sees in the project's search results respectively.
2017-08-17 22:00:37 +05:30
2021-12-11 22:18:48 +05:30
| Maintainer role | Guest role |
2021-09-04 01:27:46 +05:30
|:---------------------------------------------------------------------------------------|:---------------------------------------------------------------------------------|
2021-03-08 18:12:59 +05:30
| ![Confidential issues search by maintainer](img/confidential_issues_search_master.png) | ![Confidential issues search by guest](img/confidential_issues_search_guest.png) |
2019-10-12 21:52:04 +05:30
2022-01-26 12:08:38 +05:30
## Related topics
2019-10-12 21:52:04 +05:30
2021-10-27 15:23:28 +05:30
- [Merge requests for confidential issues](../merge_requests/confidential.md)
- [Make an epic confidential](../../group/epics/manage_epics.md#make-an-epic-confidential)
2022-07-16 23:28:13 +05:30
- [Add an internal note](../../discussions/index.md#add-an-internal-note)
2021-10-27 15:23:28 +05:30
- [Security practices for confidential merge requests](https://gitlab.com/gitlab-org/release/docs/blob/master/general/security/developer.md#security-releases-critical-non-critical-as-a-developer) at GitLab