As AI keeps improving, our security policies are changing in response. Based on recent analyses, we're going to ask that you return to separating tests into a separate patch from the fix for a security issue. This applies to both sec-high and sec-moderate bugs.
We ask that you hold the tests until a short while after the release ships. If a fix ships in a Firefox version released on a Tuesday, we ask you land the test no sooner than the next Tuesday. You can set a reminder for yourself in the whiteboard using the tag [reminder-test 2026-10-20] and a bot will needinfo you to remind you on that date.
This does not change the sec-approval process (for now.) We know there's been a lot of changes with the process for landing security fixes, and we know it's disruptive and difficult to keep track of. We are working to improve the processes to reduce friction.
On behalf of the security team,
tom