In order for the Commons app to remain on the WMF account, we need to ensure that their authentication logic is in line with our privacy policy.

To do that, we need to do a code review of the authentication code and ensure credentials are securely stored and transmitted and not sent to any 3rd parties.

Some more specific points to check:

• Ensure that the app makes correct use of the system AccountManager for storing credentials, and doesn't store them anywhere else.
  • Side track: Consider sharing account credentials between our app and the Commons app, which is easily done with AccountManager.
• Make sure the app uses SSL for all API requests, especially when transmitting credentials.
• Make sure that no kinds of credentials / API keys / etc. are checked into the repo itself.