I just filed bug 1334637, which had a "this is a security bug" checkbox set. I requested needinfo from someone in the initial bug creation step. Upon filing the bug, needinfo was open-ended and set to "anyone." I tried to set needinfo to this person on the filed bug but got an error saying the person didn't have privileges to access the bug. Adding them to the CC list allowed the needinfo from them to be set. The bug here is that attempting to set a needinfo during bug filing to someone that doesn't have access to the bug results in the needinfo silently being set to "anyone." I think there should be an error filing the bug in this scenario to make it clear the needinfo wasn't set.
You need to log in before you can comment on or make changes to this bug.