document the issue about confidential issues

Closes: gitlab#23

howto/gitlab.md

@@ -56,6 +56,20 @@ you have [searched the GitLab project for similar bugs][search].
 If you do *not* have access to GitLab, you can email
 <gitlab-admin@torproject.org>.
 
+### Note about confidential issues
+
+Note that you can mark issues as "confidentials" which will make them
+private to the members of the project the issue is reported on (the
+"developers" group and above, specifically).
+
+Keep in mind, however, that it is still possible issue information
+gets leaked in cleartext, however. For example, GitLab [sends email
+notifications in cleartext for private issue](https://gitlab.com/gitlab-org/gitlab/-/issues/5816), an known upstream
+issue. (We have [decided we cannot fix this ourselves in GitLab for
+now](https://gitlab.torproject.org/tpo/tpa/gitlab/-/issues/23).) Some repositories might also have "web hooks" that notify
+IRC bots in clear text as well, although at the time of writing all
+projects are correctly configured.
+
 ## How to contribute code?
 
 As reporting an issue, you first need to figure out which project you