• Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      Issue Summary

      There is no functionality to delete Pull request in case if any sensitive data is is being committed.

      Steps to Reproduce

      • You may accidentally commit something like a password in a fork of a repo
      • Create a Pull Request
      • No option to delete the Pull request

      Expected Results

      There should be functionality to delete the Pull request

      Actual Results

      Currently, there is no way to remove that PR once created resulting in your sensitive data being shown in the PR diff forever.

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

            [BCLOUD-8089] Deletion of a Pull request is not possible

            jake-kcm added a comment -

            The amount of time and effort spent avoiding this is laughable

            jake-kcm added a comment - The amount of time and effort spent avoiding this is laughable

            Stefan C. added a comment -

            Here the link to the created suggestion https://jira.atlassian.com/browse/BCLOUD-22181  for all those who voted here due to the "second motivation" to easily vote for the follow up.

            Stefan C. added a comment - Here the link to the created suggestion https://jira.atlassian.com/browse/BCLOUD-22181   for all those who voted here due to the "second motivation" to easily vote for the follow up.

            Katarína Lukácsy added a comment - - edited

            We have reviewed the comments on this BCLOUD. The requests for Bitbucket Cloud to support a functionality to delete pull requests seem to be motivated by two primary reasons:

             

            The first is regarding sensitive data being shown in a pull request diff. Customers who find sensitive data pushed into a pull request are looking for a way to remove this sensitive data by deleting the affected pull request.

            We want to emphasize that deleting a pull request is not effective in this scenario, as the underlying commits containing sensitive data still exist in the repository and the sensitive data can still be accessed. The best thing to do in situations like this is to assume the data has been compromised. If these are passwords for example, it is recommended to rotate them.

            There will of course be situations where you may not be able to take those steps, or you want to remove this data from the repository regardless. There are steps you can take to do that and we found that our existing documentation on this topic was not sufficient.

            We have published a new tutorial which will walk you through the appropriate steps in these situations:

            https://confluence.atlassian.com/bbkb/what-to-do-if-you-ve-committed-sensitive-data-to-a-bitbucket-cloud-repository-1168857188.html

             

            The second motivation to delete pull requests is associated with administrative preferences to delete accidental or unnecessary pull requests. The current recommended workflow in Bitbucket Cloud is to decline these but we understand that some customers simply prefer to have these removed from their repositories altogether. To separate this specific feature request from concerns about sensitive data, we have created a new BCLOUD to track the feature request specifically for these reasons. We will gather your interest in this feature and we will evaluate it over time. In the short-term we do not plan to prioritize this feature as it currently does not align with our long-term roadmap. You can review our public roadmap here: https://www.atlassian.com/roadmap/cloud?selectedProduct=bitbucket

             

            Katarína Lukácsy added a comment - - edited We have reviewed the comments on this BCLOUD. The requests for Bitbucket Cloud to support a functionality to delete pull requests seem to be motivated by two primary reasons:   The first is regarding sensitive data being shown in a pull request diff. Customers who find sensitive data pushed into a pull request are looking for a way to remove this sensitive data by deleting the affected pull request. We want to emphasize that deleting a pull request is not effective in this scenario, as the underlying commits containing sensitive data still exist in the repository and the sensitive data can still be accessed. The best thing to do in situations like this is to assume the data has been compromised. If these are passwords for example, it is recommended to rotate them. There will of course be situations where you may not be able to take those steps, or you want to remove this data from the repository regardless. There are steps you can take to do that and we found that our existing documentation on this topic was not sufficient. We have published a new tutorial which will walk you through the appropriate steps in these situations: https://confluence.atlassian.com/bbkb/what-to-do-if-you-ve-committed-sensitive-data-to-a-bitbucket-cloud-repository-1168857188.html   The second motivation to delete pull requests is associated with administrative preferences to delete accidental or unnecessary pull requests. The current recommended workflow in Bitbucket Cloud is to decline these but we understand that some customers simply prefer to have these removed from their repositories altogether. To separate this specific feature request from concerns about sensitive data, we have created a new BCLOUD to track the feature request specifically for these reasons. We will gather your interest in this feature and we will evaluate it over time. In the short-term we do not plan to prioritize this feature as it currently does not align with our long-term roadmap. You can review our public roadmap here: https://www.atlassian.com/roadmap/cloud?selectedProduct=bitbucket  

            We are reviewing the comments provided in this ticket and we are working on remediation plan for the most common pain points shared in this ticket.

            Katarína Lukácsy added a comment - We are reviewing the comments provided in this ticket and we are working on remediation plan for the most common pain points shared in this ticket.

            Khoa Au added a comment -

            Perhaps a workaround could be forking your repo somewhere, then delete the original repo, then fork again from your forked repo. 

            Khoa Au added a comment - Perhaps a workaround could be forking your repo somewhere, then delete the original repo, then fork again from your forked repo. 

            ysu ysu added a comment -

            Sure it's coming.   Like the comet that will wipe out humanity.   We just don't know when it'll arrive, but unlikely in our lifetime.

             

            Atlassian is a pile of s...shockingly poor decisions.

            ysu ysu added a comment - Sure it's coming.   Like the comet that will wipe out humanity.   We just don't know when it'll arrive, but unlikely in our lifetime.   Atlassian is a pile of s...shockingly poor decisions.

            hlam added a comment -

            Is this coming?

            hlam added a comment - Is this coming?

            It seems to be totally useless to write any comment to this request. The ticket has been created nearly 10 (in words: ten) years ago. I contacted the founders because of another request … they wrote back, that only very popular requests are processed. I cannot believe this. The issue was one of the top ten voted … created many years ago, not processed yet.

            Maybe you should vote and pray …

            Oliver Friedrich added a comment - It seems to be totally useless to write any comment to this request. The ticket has been created nearly 10 (in words: ten) years ago. I contacted the founders because of another request … they wrote back, that only very popular requests are processed. I cannot believe this. The issue was one of the top ten voted … created many years ago, not processed yet. Maybe you should vote and pray …

            I'm pretty shocked that it isn't possible to delete a PR. Beyond just wanting to keep cancelled or declined PR's pruned for tidiness, this does seem like a potential security risk if PII is accidentally revealed.

            Brian Saghy added a comment - I'm pretty shocked that it isn't possible to delete a PR. Beyond just wanting to keep cancelled or declined PR's pruned for tidiness, this does seem like a potential security risk if PII is accidentally revealed.

            hpuc added a comment -

            This seems to violate the GDPR right for erasure: Someone accidentally adds some personal information in a PR, and that's it. I find it quite disconcerting that a functionality so simple and relevant has not been implemented for such a long time.

            hpuc added a comment - This seems to violate the GDPR right for erasure: Someone accidentally adds some personal information in a PR, and that's it. I find it quite disconcerting that a functionality so simple and relevant has not been implemented for such a long time.

              075ab5416c8c Katarína Lukácsy
              legacy-bitbucket-user Legacy Bitbucket Cloud User (Inactive)
              Votes:
              436 Vote for this issue
              Watchers:
              222 Start watching this issue

                Created:
                Updated:
                Resolved: