diff --git a/core/src/main/java/jenkins/security/CallableDirectionChecker.java b/core/src/main/java/jenkins/security/CallableDirectionChecker.java
index 6d3a8437d4..44e30d2441 100644
--- a/core/src/main/java/jenkins/security/CallableDirectionChecker.java
+++ b/core/src/main/java/jenkins/security/CallableDirectionChecker.java
@@ -50,8 +50,9 @@ public class CallableDirectionChecker extends RoleChecker {
 
     /**
      * Test feature that is meant to replace all logging, and log what would have been violations.
+     * TODO delete before release
      */
-    public static PrintWriter BYPASS_LOG;
+    private static final PrintWriter BYPASS_LOG;
 
     static {
         String log = System.getProperty(CallableDirectionChecker.class.getName()+".log");
diff --git a/core/src/main/java/jenkins/security/DefaultFilePathFilter.java b/core/src/main/java/jenkins/security/DefaultFilePathFilter.java
index 98c25f0eda..ec6f4bb9e2 100644
--- a/core/src/main/java/jenkins/security/DefaultFilePathFilter.java
+++ b/core/src/main/java/jenkins/security/DefaultFilePathFilter.java
@@ -52,7 +52,7 @@ import org.kohsuke.accmod.restrictions.DoNotUse;
      * Escape hatch to disable this check completely.
      */
     public static boolean BYPASS = Boolean.getBoolean(DefaultFilePathFilter.class.getName()+".allow");
-    private static final PrintWriter BYPASS_LOG;
+    private static final PrintWriter BYPASS_LOG; // TODO delete before release
     static {
         String log = System.getProperty("jenkins.security.DefaultFilePathFilter.log");
         if (log == null) {