Security/Reviews/

Introduction

Security Review is a service provided Firefox Security Engineering to review the design of features to ensure appropriate consideration of threats, and mitigation of common security flaws. Security Review is usually performed towards the end of a design of a feature, prior to implementation. To request a security review, send an email to secreview@mozilla.com.

Process

1. Make a copy of the security review template and fill in the sections. Please allow "Mozillians with the link" to comment on the document
2. Send an email to secreview@mozilla.com to request a review, linking to the filled-in request template
3. Feature EPM or dev lead will schedule a meeting to review details and discuss risks
4. Follow-up items: Fixing issues, and optionally Security Testing

FAQ

Do I need to do a security review ship a feature?

No, this process is optional, to assist teams with understanding security issues related to their features. However this process is strongly encouraged for any security sensitive features i.e. those involving sensitive user data (PII or passwords), or features which involve browser security mechanisms like TLS, dom security APIs, permissions etc.

What is the difference between Security Review and Security Testing

Security review is a high level design review intended to ensure that a feature considers all risks as part of the building of a feature. Security Testing is specific testing of a feature once it is built to ensure that it is free of common implementation flaws, and also that any security controls critical to the feature are functioning correctly.

Legacy Reviews

Old Security Review can be found here: Security/Archived/Reviews/