Oh, I see where the bug description could have been misinterpreted--the expectation on this particular issue (since there's a corresponding public bug which doesn't mention any security implications) was that it could be fixed in public without discussing this private bug report. However the commit message unfortunately mentions both bug numbers rather than just the public bug.
Oh, I see where the bug description could have been misinterpreted--the expectation on this particular issue (since there's a corresponding public bug which doesn't mention any security implications) was that it could be fixed in public without discussing this private bug report. However the commit message unfortunately mentions both bug numbers rather than just the public bug.