Ideally, the vast majority of Security tasks would be made public after issues are resolved to be as transparent as possible. This hope has been met with varying levels of success in the past as reviewing issues for PI/PII/problematic logs/related and remaining issues is timeconsuming.

One strategy discussed is to create a tag that we can use to mark tasks as "This is explicitly not eligible for being made public due to the presence of restricted information on the task" to start making headway on historic tasks and to be more careful with existing open tasks. At the moment it's difficult to know if someone has already determined a task is an issue for making public or not, and there is no way to mark a task as not-eligible when you know sensitive information is being added in real time.

Thus we are going to try out a tag for this purpose named #PermanentlyPrivate