We get dozens of "high-priority" security issues filed that are resolved with "we're an open-source project; this information is public on purpose".

Our bug bounty clearly outlines that chat, Jira, Confluence, our website - all out-of-bounds. Almost all of our reports are on those properties.