---
id: "lib-2026-10-20-firefox-security-patch-tests-are-now-private-for"
type: "library"
title: "Firefox security patch tests are now private for at least a week"
lang: "EN"
org: "Mozilla"
source_type: "Practitioner post"
date: "2026-10-20"
week: "2026-W43"
url: "https://nosov.ai/library/lib-2026-10-20-firefox-security-patch-tests-are-now-private-for/"
original_url: "https://groups.google.com/a/mozilla.org/g/firefox-dev/c/4I1HSPtVyrI/m/giGra4ZzAQAJ"
tier: "B"
tier_name: "Useful, limited"
tier_reason: "A first-hand Mozilla security-team policy notice that ties a concrete process change to AI capability, but it is three paragraphs long and cites analyses it does not share."
summary_basis: "full-text"
original_minutes: "1"
tags: ["ai security", "disclosure policy", "patch to exploit"]
---

# Firefox security patch tests are now private for at least a week

Tier B (Useful, limited): A first-hand Mozilla security-team policy notice that ties a concrete process change to AI capability, but it is three paragraphs long and cites analyses it does not share.

Summary based on the full text.

## In short

On 20 October 2026 Tom Ritter, writing for Mozilla's security team on the firefox-dev list, asked developers to split tests into a separate patch from the fix for sec-high and sec-moderate bugs, and to hold the tests until about a week after the fix ships. The stated reason: "As AI keeps improving, our security policies are changing in response", based on recent analyses that are not described.

## Key numbers

- sec-high and sec-moderate: Firefox bug severities whose tests must now land separately from the fix
- the next Tuesday: earliest landing date for a test after the Tuesday release that ships the fix

## What it reports

- Tests for sec-high and sec-moderate fixes must be in a separate patch from the fix itself.
- If a fix ships in a Firefox release on a Tuesday, the test lands no sooner than the next Tuesday.
- Developers can tag the bug whiteboard with a reminder and a bot will ping them on the date.
- The sec-approval process is unchanged "for now".
- The team acknowledges frequent, disruptive changes to the process for landing security fixes.

## How they got it

An internal-process announcement on a public mailing list. The "recent analyses" behind it are not shared.

## Limits

- No data on how quickly attackers derive exploits from public tests, or what the analyses found.
- Short notice; the reasoning is implied (tests reveal the bug) rather than stated.
- Policy may change again; the message flags further process work.

## Why it matters for companies

A major browser vendor now treats a public test case as an exploit hint that models can turn into an attack within days. The same logic applies to any company publishing patches: commit messages, tests and diffs can reveal the flaw before customers have updated. Patch release processes should assume fast automated diff analysis and delay revealing artefacts accordingly.

Original: https://groups.google.com/a/mozilla.org/g/firefox-dev/c/4I1HSPtVyrI/m/giGra4ZzAQAJ