Wikimedia Security Team/Security Review Planning/2026-07-01

Minutes for the Security Team's Q1 2027 (FY27) (July to September) quarterly planning session

Date: 2026-07-01

Secscrum board: https://phabricator.wikimedia.org/tag/secscrum/

Attending: APrum-WMF, ASanford-WMF, MMartorana_(WMF), MStyles_(WMF), Reedy, Roan_Kattouw_(WMF), RScout-WMF, RSilvola-WMF, SBassett_(WMF)

Completed Reviews, Previous Quarter

1. Article Guidance extension - ASanford-WMF - T419136#11820369 - completed, high vuln feature removed.
2. Evaluator-Orchestrator callbacks to Wikifunctions - SBassett_(WMF) - T418394#12050936 - completed, likely follow-up for AI-assisted review skills/processes for PSI.

Reviews That Need Follow-Up or are Still In-Progress This Quarter

1. WordPress remote access to CiviCRM - MMartorana_(WMF) - T381978#10753270 - Review completed, follow up in future with a Claude review.
2. Org app - SBassett_(WMF) - T411742 - TM sessions completed, possibly follow up with code reviews (CI, manual, etc.)
3. WDQS vendor db analysis - MStyles_(WMF), APrum-WMF - T413229 - to verify results and resolve task.
4. WDQS proxy service (java) - MMartorana_(WMF) - T421885#12055904 - need to follow up with requester regarding issues resolution.
5. SwaggerUI - SBassett_(WMF) - T425451 - follow up with progress

Accepted Reviews To Complete This Quarter

1. WikiFunctions Rust Evaluator - SBassett_(WMF) - T430103 - assigned, possible sooner delivery date
2. ext:Produnto - RScout-WMF, MStyles_(WMF) - T423761 - co-review
3. WMF WordPress config audit - ASanford-WMF, MMartorana_(WMF) - T426474 - co-review, to focus on config, vendor-y issues
4. TWN general review - unassigned - T424647 - SBassett_(WMF), RSilvola-WMF to schedule initial consultation