I would like to keep both public and private issues in my team's github repo. I'd rather prefer that some issues are not open to other people than just my teamates.
2 Answers
You cannot. GitHub (still) does not support Confidential Issues. This is a major problem for open-source projects that want to track security bugs using GitHub Issues or record bug notes that contain PII.
My recommendation is to use create a public issue in your GitHub repo but with an arbitrary or disguised title and description and add tags/metadata that reference the same confidential issue in a non-public store, such as a hosted Bugzilla - you could set-up two-way integration between the two too, using their webhooks and events systems.
The new Security Advisory feature is a neat way to discuss and fix confidential security issues. You can create a confidential Security Advisory draft (in Security tab) to discuss the issue, and elaborate solution within a confidential branch. You can publish the final advisory, if you want, or even assign CVE number.
Related