I uploaded a file to a security ticket; the file's permissions were "author or subscribers of attached objects" (a screenshot of some sensitive information exhibiting a security bug).

I then wanted to 'declassify' the security ticket and make it available to all, but as the file contained sensitive information I edited my comment to remove it. I expected that no one other than myself should've been able to see it after I edited the comment. In practice, the file was still visible in the history (even though not visible on first look), and I had to delete the image from the system to avoid a leak.