Bitbucket: Users occasionally able to mention users outside the workspace on a private repository
Timeline of updates
- resolved
We received reports today that users were sometimes able to mention other users on pull request comments from outside the workspaces of private repositories. This issue has already been resolved, but we are creating this incident for transparency with the intention of providing a more detailed description of what went wrong and how we resolved the issue in the postmortem for this incident. The good news is that we have determined this issue did not result in any unauthorized access to sensitive data. This will be explained in greater detail in the postmortem momentarily.
From Bitbucket’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on bitbucket.status.atlassian.com (opens in new tab).
Cite this
Status incident (vendor impact label: minor) posted by Bitbucket, started 2021-05-28 18:00 UTC, resolved after 0 min, 1 update(s).
- Title
- Users occasionally able to mention users outside the workspace on a private repository
- Vendor
- Bitbucket
- Date
- URL
- https://rewindex.com/company/bitbucket/incidents/43px69wb3ftx
Bitbucket profileRecent Bitbucket incidentsAll outages on May 28, 2021Bitbucket in May 2021MarkdownJSON