1365675 - Start a security audit communication

Status: RESOLVED FIXED

(Socorro :: Symbols, task)

Description

[Peter Bengtsson [:peterbe]]

Tecken [0] is soon going into production. 

What does it take to sign this off security-wise?


[0] https://github.com/mozilla-services/tecken

Comment 1

[Peter Bengtsson [:peterbe]]

Greg, 
Can you own this bug and lead with whatever it takes to check that tecken is secure enough to go to production?

Comment 2

[Greg G]

+1 I opened a bugs 

to schedule a risk assessment: https://bugzilla.mozilla.org/show_bug.cgi?id=1365673 
for code review: https://github.com/mozilla-services/foxsec/issues/317
and I'll check with my team about infrastructure review.

Comment 3

[Greg G]

I didn't find anything that would block deploying to prod in code review and the old RRA still applies.

We'll run a quick RRA update for the new functionality when its design is ready, but in the meantime it's feature flagged defaulting to disabled.