627105 - Make the ability to add bugs to the security group easier to get

Status: NEW

(Core :: Security, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

I have noticed cases where security-related bugs (e.g. bug 627097) are being flagged "Mozilla Confidential" instead of put into the security group. My guess is that this is being done because most people don't have the ability to add a bug to the security group after it has been reported. I know I have run into this problem and so have others. I think we should grant this capability to more users (e.g. everybody with level 1 commit access), so that these bugs can be properly managed and properly evaluated by the security team.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Yeah, this is silly.  People can flag bugs sec-sensitive when filing, but not later....  Anyone should be able to mark a bug sec-sensitive, imo; just not to unmark.  Does that need bugzilla backend work?  :(