Firefox security team now requires tests for security fixes to be held back until at least a week after the fix ships, to prevent attackers from learning exploit details through test code. This applies to sec-high and sec-moderate bugs, with tests landing no sooner than the next Tuesday after release.
Background
Mozilla has been gradually increasing security disclosure delays as AI tools make it easier to reverse-engineer vulnerabilities from test code.
- Source
- Lobsters
- Published
- Oct 21, 2026 at 03:13 PM
- Score
- 7.0 / 10