Why not have a single project, and then set confidential reports to private status, and only give the client accounts that can't see private issues?

Anyways, the 'official' method for what you want is what you're already doing, although I think it would be nice to be given an option during the clone process to choose a different project for the cloned issue.

Who can view the private post? It will be the higher access level right? In that case, we can't have Developer on the side of our client, in our case we have the devs here and client's dev that are helping or sometimes messing our work. :-) If we could have a copy, it will be easier to manage and also to track our and their activity.

Cheers!

You could alter the permission thresholds, combined with either setting the clients as a lower level, or adding a new level for privileged developers, and separate the viewing of private issues in that manner. E.g., set client developers to level UPDATER, in-house developers to level DEVELOPER, and then set access thresholds for viewing private issues to DEVELOPER, so that only your in-house devs can see them.

+1