# Feature COMMS-943 - Clarify that project identifiers are non-confidential when project-based semantic work package identifiers are used

Project: Stream Communicator
Status: closed
URL: https://community.openproject.org/work_packages/COMMS-943

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | 17.8.0 |
| Sprint | Sprint 10 |
| Backlog bucket |  |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Judith Roth |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

**As** a user creating or editing a project or project identifier in semantic mode  
**I want to** know that the project identifier is public information (in certain cases)  
**so that** I don't accidentally expose sensitive information

**Acceptance criteria**

*   At all places where a project identifier can be changed or initialized, there is a warning: "Project identifiers aren't private. If your project is confidential, choose a nondescript identifier."
    
*   The warning is only shown when the instance used project-based work package identifiers (not for classic numeric ones)
    
*   The documentation is adapted to include a more detailed warning: 
    

> Project identifier visibility
> 
> A project's identifier is not restricted to its members and should not be treated as confidential, even if the project itself is private.
> 
> Work packages can be linked from within a document, using the work package's identifier (e.g. PROJ-123) or a rich link. If such a document becomes visible to users outside the project, the project identifier is exposed along with it (no other information about the work package will be exposed).
> 
> This can happen in a few ways:
> 
> Public projects: If a project is set to public, its Documents module — if enabled — is visible to other users of the instance according to their Non member role permissions, without requiring project membership.  
> Anonymous access: If the instance permits access without authentication, a public project's documents may additionally be visible to unauthenticated visitors, governed by the Anonymous role.  
> Cross-project references: A document in one project can reference a work package from another project. If that document's own project is public (or otherwise accessible to a wider audience), the identifier of the referenced project becomes visible too — even if the referenced project itself is private.
> 
> Because of these paths, a project identifier should be treated as potentially visible to any user of the instance, and in some configurations, the general public. If the identifier itself could reveal sensitive information (e.g. a client name or project codename), choose a nondescript identifier when creating the project.

<br>

**Technical notes**

*   <br>
    

**Permissions and visibility considerations**

*   _To whom is this feature visible?_
    
*   _When is it not visible?_
    

**Translation considerations**

*   _Key terms and phrases in the key languages_
    

**Out of scope**

*   <br>
    

_Set the_ **To be informed/consulted teams** _field to include all teams necessary to be informed of the changes._