Please hold tests until security fixes ship – Firefox security team

Mozilla's Firefox security team is asking developers to again separate tests from security fixes into a distinct patch for both sec-high and sec-moderate bugs, and to hold those tests until at least one week after the fix ships — a fix released on a Tuesday means the test lands no sooner than the following Tuesday. The team said the change, attributed to improving AI and "recent analyses," does not alter the sec-approval process for now, and developers can set a whiteboard reminder tag such as [reminder-test 2026-10-20] so a bot will needinfo them on that date.

As AI keeps improving, our security policies are changing in response. Based on recent analyses, we're going to ask that you return to separating tests into a separate patch from the fix for a security issue. This applies to both sec-high and sec-moderate bugs. We ask that you hold the tests until a short while after the release ships. If a fix ships in a Firefox version released on a Tuesday, we ask you land the test no sooner than the next Tuesday. You can set a reminder for yourself in the whiteboard using the tag reminder-test 2026-10-20 and a bot will needinfo you to remind you on that date. This does not change the sec-approval process for now. We know there's been a lot of changes with the process for landing security fixes, and we know it's disruptive and difficult to keep track of. We are working to improve the processes to reduce friction. On behalf of the security team, tom