Since then, Paladox's +2 access has been used on multiple occasions for security issues (example T394383) so they can be +2'd on gerrit and quickly deployed to Miraheze.

I have manually added paladox to a few tasks for this reason and after talking to @sbassett feel it is reasonable that paladox is given security issue access so they are able to further and quickly assist in the deployment and response to security issues with non-Wikimedia deployed extensions.

Related Objects

Mentioned Here: T355619: Request MediaWiki +2 for Paladox
T394383: CVE-2025-53487: Stored XSS through system messages in Extension:ApprovedRevs

Event Timeline

RhinosF1 created this task.May 19 2025, 5:14 PM

Restricted Application added a project: affects-Miraheze. · View Herald TranscriptMay 19 2025, 5:14 PM

Restricted Application added subscribers: Reception123, Aklapper. · View Herald Transcript

sbassett added a project: Security-Team.May 19 2025, 5:15 PM

Wrong form/tags, see https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Policy/Access_To_Security_Issues :)

A_smart_kitten added a project: Security.May 19 2025, 5:48 PM

Paladox subscribed.May 19 2025, 6:11 PM

In T394708#10836144, @Aklapper wrote:

Wrong form/tags, see https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Policy/Access_To_Security_Issues :)

I followed https://wikitech.wikimedia.org/wiki/Volunteer_NDA because you need an NDA as part of getting security issue access

Mstyles moved this task from Incoming to In Progress on the Security-Team board.May 27 2025, 4:01 PM

I'm following up with Legal and any other internal concerns and will report back with more information

I reached out to Legal and they do not have a NDA signed for @Paladox. Could you go ahead and start that process?

@KFrancis: can you start that?

Sure, no problem! @Paladox , to process an NDA for you, I'll need the following information: Your legal name, your mailing/postal address, your email and please provide some information about the access you need. To protect your privacy, please send these items to kfrancis@wikimedia.org. Thank you!

In T394708#10868675, @KFrancis wrote:

Sure, no problem! @Paladox , to process an NDA for you, I'll need the following information: Your legal name, your mailing/postal address, your email and please provide some information about the access you need. To protect your privacy, please send these items to kfrancis@wikimedia.org. Thank you!

Thanks, sent!

Hi all, the NDA is out for signatures. I'll confirm when it's complete.

In T394708#10868875, @KFrancis wrote:

Hi all, the NDA is out for signatures. I'll confirm when it's complete.

Thanks, signed!

@KFrancis any update for the NDA since it's been signed?

Hi @Mstyles, just waiting on legal counsel to counter sign. I have pinged him. Thanks!

Hi @Mstyles, the NDA has been signed. Thanks!

Thanks so much @KFrancis. @Paladox we will need you to add 2FA to your account before security issue access can be granted. Please set up 2FA.

In T394708#10895930, @Mstyles wrote:

Thanks so much @KFrancis. @Paladox we will need you to add 2FA to your account before security issue access can be granted. Please set up 2FA.

@Mstyles Done

In T394708#10895933, @Paladox wrote:

@Mstyles Done

Confirmed:

Security issue access granted

Thank you!

sbassett added a project: SecTeam-Processed.Jun 9 2025, 4:16 PM

Thanks all!

Security issue access for PaladoxClosed, ResolvedPublicActions

Description

Related Objects

Event Timeline

Security issue access for Paladox
Closed, ResolvedPublic
Actions