Jira Cloud has no default comment visibility. Here are 4 workarounds (and a free app)

Every new Jira Cloud comment is "Viewable by All Users" unless someone remembers the lock icon. Atlassian's request for a default (JRACLOUD-9091) sits at 990 votes and is still "Gathering Interest". If your projects include clients or contractors, one forgotten click leaks an internal note.

What actually works today:

1. Click the lock every time. Free, error-prone.
2. Automation rule that re-restricts after posting. The rule actor must be a real user in the target role (Atlassian treats the Automation user not joining roles as expected behaviour, JSWCLOUD-22454). Notifications go out before the fix.
3. REST API POST /rest/api/3/issue/{key}/comment with a visibility object. Atlassian's own KB workaround for team-managed projects (JRACLOUD-83171).
4. Use JSM if you can: it has real internal vs. reply-to-customer comments.

I build small Forge apps under the name Loomwise, and wrote a free one for this: Loomwise Private Comments restricts new comments to a role or group you choose per project, and runs entirely on Atlassian (Forge, no data leaves your site). Full guide and install: https://loomwise.app/jira-private-comments/

Questions or edge cases: [e-mail].