Issue Summary

• Adding an SSH access key to a specific repository unexpectedly grants SSH access to all public repositories.

Steps to Reproduce

• Create Public repo.
• Create a Private repo.
• Attempt to clone the public repository via SSH – the operation should fail.
• Generate an SSH Access key and add it to the private repository.
• Attempt to clone the public repository again – this time, it succeeds.

Expected Results

• Bitbucket should enforce SSH access key boundaries, preventing SSH cloning of public repositories unless the key is explicitly added to the repository or user profile.

Actual Results

• Addition of access key to seperate repository enables access to all Public repository over ssh.

Workaround

• Currently the only workaround is to disable Public repository Access either globally or for a particular repository.