Phabricator Username: zoe
Reasons For Request: WMF employee / my team fielded a security ticket recently and it would be useful to not need to be manually added for the next one
| zoe | |
| Aug 1 2025, 3:19 PM |
| F65700698: Screenshot 2025-08-01 at 10.21.31 AM.png | |
| Aug 1 2025, 3:22 PM |
Phabricator Username: zoe
Reasons For Request: WMF employee / my team fielded a security ticket recently and it would be useful to not need to be manually added for the next one
Before this can be approved, I would like some more context on this ticket to support the request. What security ticket was fielded? Why do we think it will be so recurring that manual adding will be a big hassle?
If that's the threshold I think I probably don't meet it. I can keep being manually added to tickets on a need-to-know basis.
We've typically granted WMF staff Phab security access, no questions asked, for the past several years, given that everyone is NDA'd and it doesn't significantly increase our attack surface in any meaningful way. If we do not wish to continue this practice, then we should update https://www.mediawiki.org/wiki/Security/SOP/Access_to_Phabricator_Security_Issues to include any additional requirements for said access.
Thanks @zoe, I think that's probably the right call for now.
I've updated https://www.mediawiki.org/wiki/Security/SOP/Access_to_Phabricator_Security_Issues#Guidance_to_WMF_staff with some text to this effect.