If it was filed as a security issue, most well-set-up projects with public issue trackers would keep it closed off only to a reporter and internal security audit team.

Perhaps it was never really declassified in the tracker.