Background
We’re introducing a new mixin to improve how we track session-related metrics. It builds on the existing “session tick” tool but adds functionality for more detailed insights, like understanding how a new search recommendation feature affects session behavior.
Before rolling this out, we need a Legal and Security Review to make sure we’re compliant with policies.
User Story
As the Web team, we want to make sure the new mixin meets all legal, security, and privacy standards.
Requirements
- Confirm that storing session IDs and contextual data in local storage is compliant with our policies.
- We receive a classification of the mixin’s risk level (low, medium, or high) using existing guidelines and outline necessary mitigations.
BDD
N/A
Test Steps
N/A
Design
N/A
Acceptance Criteria
- Legal and security reviews are completed with no major blockers, or clear mitigation steps are provided.
- Risk classification is documented, and mitigation plans (if needed) are in place.
- The review findings are shared with all relevant teams (e.g., Data Eng, Web Team).
Communication Criteria
- Notify all stakeholders of the review results and any required changes.
- If needed, schedule follow-ups to discuss concerns or update the mixin’s design.
Rollback Plan
If the review uncovers issues we can’t resolve right away, we’ll pause implementation and explore alternative approaches or redesign the mixin.