Security for Mentions doesn't seem to work correctly

[Jeff White]

I have mutliple clients that have distinct projects in JIRA and those clients have JIRA users.  The problem is that client users in one project are able to see client users in another project / company when using the  @ Mention function. .  

I have followed the instructions here.  

https://confluence.atlassian.com/display/JIRAKB/Mentions+are+Not+Working+in+JIRA

Specifically, I've tried used Step 5 which tells me that users that do not have the Browse Project permission for the project where the mention is occurring should not work.    

but... it doesn't seem to work.  Is this a bug or am I missing something?  

https://confluence.atlassian.com/display/JIRAKB/Mentions+are+Not+Working+in+JIRACapture.PNG

[Jeff White]

thanks. sounds like this is a long - known problem. :(

[Steven F Behnke]

My coworker answered this question the other day, I'll link his answer: Security for Mentions (https://answers.atlassian.com/questions/8623220/security-for-mentions)