I have two projects, projectA and projectB. Issue security for projectA is fairly open, but projectB is fairly closed. If I have issues in both projects and I link an issue in projectA to an issue in projectB, JIRA behaves correctly in that a user viewing the issue in projectA does not see the link to the issue in projectB in the links section. That's good.

However, if the user in projectA clicks on the "ALL" tab, there is an entry that shows the link to the issue in projectB. That's not so good.