799140 - SecReview: Mozillians API

Status: RESOLVED DUPLICATE of bug 751661

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Ben (:bensternthal)]

We would like a security review of the 1.0 release of the Mozillians API. 

Our current live date is November 19 and we think the sec review can happen between 11/5 - 11/16. This is an initial release of a Mozillian API  and the sec review is a launch dependency.


==================================================

Who is/are the point of contact(s) for this review?

Product owner - Aakash Desai
Developers - Giorgos Logiotatidis / Andrei Hajdukewycz
TPM - Benjamin Sternthal
    
Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):

An API for Mozillian Data. 
Wiki: https://wiki.mozilla.org/Mozillians
API Spec: https://wiki.mozilla.org/Mozillians/API-Specification (DRAFT)
    
  
Does this request block another bug? If so, please indicate the bug number This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?

This request blocks the launch of the application. https://bugzilla.mozilla.org/show_bug.cgi?id=752997

Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)

Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

This project only affects the Mozillians application.

Are there any portions of the project that interact with 3rd party services?

No

Will your application/service collect user data? If so, please describe 

No, the API exposes user data entered into mozillians, privacy controls will be added to the app as part of the project. Stacy & Tom reviewed the project via email and approved on  9/4.

If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size)

Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

We have the sec review schedules for 11/5 - 11/16.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Is this related to bug 751661 ?

Comment 2

[Ben (:bensternthal)]

Curtis so bug 751661 is this sec review but from many moons ago (I was not aware that bug existed). The data and folks working on that bug are no longer accurate.

In a nutshell we pretty much have a new team working on this.

I can either close 751661 and we can use this bug or I can resolve this one as a duplicate.

Whichever works best for your team.