In T250640#6085700, @sbassett wrote:

@DannyS712 - Is there any kind of deployment date or date where you wanted to publicize or "launch" this userJS? If not, this will probably be a lower-priority review for us, but hopefully we can get to it this quarter.

Ideally as soon as possible, but I know that this isn't requested by a WMF team and is lower priority.
As a note, the entire script is only 1650 lines, including almost 500 lines of i18n, so it shouldn't take as long as some other reviews (I assume)

Also, testing is currently done by running https://en.wikipedia.org/wiki/User:DannyS712_test/Global_watchlist_tests.js at https://en.wikipedia.org/wiki/Special:BlankPage/GlobalWatchlistTests (tests are not included in the script code itself)

Since the grant was approved, it may not make sense to conduct this review in full, but if there are any notes that I should bear in mind when converting this to an extension please let me know

General notes would be https://www.mediawiki.org/wiki/Security_for_developers and https://www.mediawiki.org/wiki/Security_checklist_for_developers

In T250640#6213656, @DannyS712 wrote:

Since the grant was approved, it may not make sense to conduct this review in full, but if there are any notes that I should bear in mind when converting this to an extension please let me know

To be honest, we should probably resolve this task and wait until the extension has been finished and a deployment date scheduled, and then file a new security review request. Sadly, given our current team resources and further complications due to Covid19, this task would need to remain an extremely low priority for the Security-Team.

In T250640#6230590, @DannyS712 wrote:

Sure. My understanding is that this needs to be security reviewed before it can be deployed, but either way I'll file a new task when the extension is (more) complete

I don't believe userJS and Gadgets have typically fallen into the category where they must have a security review before they can be "deployed". This is due in large part to there being an enormous volume of such code that spans a vast range of formality. It also isn't really viewed as "production" code, which has a very limited definition within the Wikimedia world. From an AppSec standpoint, the Security-Team tends to focus on MW core (major refactors), deployed extensions and services. And to a lesser extent, vendor code that we either self-host or vendor-host. While I think we'd love to be able to focus more on things like popular userJS and Gadgets, we just are not currently resourced to do so. And much of that wouldn't be under our direct control anyways, as both userJS and Gadgets have traditionally been managed by the community.

But yes, any new MW extension you develop that you would like deployed on Wikimedia production hardware will need a security review.