This is affecting our users as well - is there any workaround? We are trying to filter an activity log by project category but all commits from GitHub are showing up. Users who don't have permissions to view those repositories still see the commit message, but the user photo is broken and the links cannot be viewed. Due to federal security requirements, we may have to remove this gadget altogether as it's a security vulnerability. If we do not have to remove it, we would at least like the option to remove commit messages from the filter. There is already an "Activity" filter to remove certain entries - but commits aren't listed as one of the options.

barth thank you bringing up this issue. We acknowledge that DVCS Connector and Jira has issues with implementation of permissions that might lead to undesirable effects like the one you mentioned. This problem is certainly on our radar, but as in the last 3 years it didn't get much interest from customers we assume that the impact and severity isn't high enough to prioritise it over other important projects. It doesn't mean that we won't ever tackle this problem, but it is just not one of our top priorities at the moment.

so, 6 times 6 months later, any news ?

It makes the activity stream unusable due to projects with very large activity in the github repo.

This is not only a clear bug, it is also a security concern.

This occurs because the commits are synced to JIRA and Bitbucket permissions are not applied.

This is on our roadmap to investigate in the next six months.

Thanks for raising this issue.