Should capability evaluations be public or kept private?

Publishing eval results helps the research community track progress and risks, but detailed capability evals also serve as a roadmap for misuse and a scoreboard for racing. There's a real tension between transparency and information hazards. Where do you draw the line on what eval results should be public?