Why this matters for support teams
Jira’s comment-visibility model is well-designed: each comment can be scoped to a role or group, allowing internal triage and customer-facing reply to coexist on the same ticket. The flaw is the default. New comments start with All Users visibility, which means the safe behavior requires the agent to remember to switch, and the unsafe behavior requires no thought at all.
This is exactly backwards for customer-facing projects. The frequency of internal triage notes vastly exceeds the frequency of customer replies in most service projects - and yet the system biases toward the rarer, riskier choice.
Comment Security Default flips the bias. By setting the per-project default to the internal role, the common case (triage notes) becomes the default-safe path, and the deliberate case (customer reply) becomes an explicit action.
The interaction with agent training
Most support orgs train agents to “always check visibility before posting.” Comment Security Default doesn’t replace that training; it just changes what the consequences of a forgotten check are. With CSD, a forgotten check defaults to internal-only - which is recoverable and unembarrassing. Without CSD, a forgotten check defaults to All Users - which is irrecoverable once the notification email is sent.
When CSD pairs with Comment History
The pairing is straightforward: CSD reduces the rate at which leaks happen by changing the default; Comment History records what was said when a leak does occur, so the post-incident review has the data it needs. Most support teams that adopt CSD also install Comment History for the same reason - they’ve already decided the comment trail is worth investing in.
What support teams are dealing with today
- Native Jira's default comment visibility is 'All Users.' Every new comment starts public unless the agent remembers to change it.
- A new agent posts a triage note ('this customer is hard to work with, escalate to senior') with the default visibility and the customer sees it.
- Tickets in customer-facing projects (JSM service desks, support queues) are exactly the wrong place for the default to be public.
- Training agents to remember to switch visibility every time is unreliable - one tired agent is enough to leak.
- After a leak, there's no clean recovery - you can delete the comment but you can't un-send the notification email.
How Comment Security Default helps support teams
Per-project default visibility
Set the default visibility scope (e.g., 'internal staff only') per project. Every new comment in that project starts internal; the agent has to explicitly switch to All Users to send to the customer.
Visibility enforcement on transitions
Force a specific visibility when comments are posted as part of certain transitions (closing a ticket, escalating, etc.) - useful for keeping resolution notes internal even when the resolution itself is public.
Per-issue-type granularity
Different issue types in the same project can have different defaults. Internal Tasks default to internal-only; Service Requests default to All Users; Incidents default to internal-only.
Auditable enforcement
Comment Security Default's settings are visible to project admins, so it's obvious that defaults are configured. No silent behavior.
Use cases
- Service desk hardening. All JSM service desks are configured so internal triage notes default to internal-only. Customer-facing replies require an explicit visibility flip - which is the safer direction.
- Tier-2 escalation projects. Engineering projects that receive support escalations default all comments to internal staff. Reduces the risk of an engineer's diagnostic comment ('the database is melting again') reaching the original customer-reporter via a copied-down link.
- Multi-tenant support. Projects shared across tenants have customer-facing roles; the default is set to the internal role, so cross-tenant comments don't leak even if a ticket is mis-routed.
- Compliance-bound projects. Projects handling regulated data require all comments to default to a restricted role. CSD enforces this at creation time rather than relying on agent discipline.
Common questions from support teams
Does Comment Security Default block agents from posting public comments?
No - it just changes the default. Agents can still flip visibility to All Users for any comment that should be public; they just have to do it deliberately rather than accepting the unsafe default. The change is one click; the safety margin is one habit.
What if a project has both internal and customer-facing comments?
That's the normal case, and CSD is built for it. The default is set to internal because internal is the safer fallback. Customer-facing replies are explicitly switched at post time. The result is that the unsafe behavior requires a click, and the safe behavior is automatic.
Does this work on Jira Service Management?
Yes. JSM has its own internal/public concept (Add internal note vs Reply to customer), and CSD configures defaults for both standard Jira comments and JSM customer replies. Particularly useful for service desks shared with customers via the portal.
Can CSD enforce visibility on bulk comment operations or via API?
Yes. CSD enforces the default at the JIRA backend layer, so comments posted via REST API, Automation rules, or bulk operations inherit the same default. Bots that post triage notes via API won't accidentally leak via the default visibility.
Is Comment Security Default a replacement for Comment History?
No - they're complementary. CSD is preventative (stop leaks at the moment of posting). Comment History is auditable (record what was said and what was changed). Many teams install both: CSD to reduce leak frequency, Comment History to track the record when one happens anyway.
Try Comment Security Default for your team
Comment Security Default works for support teams on Jira Cloud and Data Center. Install from the Atlassian Marketplace, or read the main Comment Security Default page for the full feature list.
Try Comment Security Default on the Atlassian Marketplace ↗ See the full Comment Security Default overview →
Also built for
Comment Security Default solves a different problem for each team: