User:Superb Owl/Security

Outline of security of Wikipedia

This outline hopes to provide a general overview of the state of information security across Wikipedia and related Wikimedia Foundation work for editors who are curious to get a better sense of how robust the site's defenses are (and opportunities for editors to help strengthen the site).

Purpose

Inspiration includes discussions at Talk:Wikimedia Foundation Annual Plan/2026-2027#Product Security about:

• Number of tasks in the security backlog - 1000+ as of January 2026
• Robustness of support for passkeys and MFA
• Increased attacks in an era of LLM-assisted exploit development
  • Has the Foundation has started using AI to find and fix bugs in its code?
    • As of May 2026 it sounded like there wasn't the capacity to fix issues in the code that would be found by software like Mythos (through Project Glasswing) or Open AI's Codex Security and GPT-5.5-Cyber models (through its Patch the Planet program).
    • A presentation scheduled for September 2026 says WMF will briefly touch on this as a future work item: "Then we’ll talk briefly about what we’re up to next: How do we protect users and their accounts at scale when even the code is customizable? How can we use the dramatic advancements that have been made in AI-assisted security analysis to our advantage?" (note: this talk will not be recorded or livestreamed)
• Risks of user scripts
• Fragmentation of risk management

This outline could help us:

• Ask staff and leadership good questions about concerns, issues, and potential gaps
• Advocate in constructive ways for improvements and re-prioritizations
• Contribute expertise based on experience as community members

High-level information

Places where information lives

The following table is copied from Reporting security bugs:

Project	Use by Product Safety and Integrity
mediawiki.org	General content for Policy, SOPs, etc. PSI team page.
wikitech.wikimedia.org	Procedural or instructional material that is not training.
meta.wikimedia.org	Policy and other content for translation. Use Category:Security to browse pages.
office.wikimedia.org	Sensitive or private content. Must have an NDA and appropriate access.
foundation.wikimedia.org	Canonical location for Policy

Wikimedia technical documentation: mediawiki.org/wiki/Documentation/Find docs + Wikimedia Technical Documentation Team

Foundation structure

• Wikimedia Foundation/Organizational chart
  • Product and Technology teams
    • Site Reliability Engineering
      • Vice President (1)
      • Director (1)
      • + ~50? FTEs
  • Wikimedia Product

Editors

Responsible teams: Product Safety and Integrity, Human Rights Team (legal)

Resources

• Information pages:
  • Wikipedia:Personal security practices
  • Wikipedia:User account security
    • Wikipedia:Password strength requirements - Special:PasswordPolicies + Meta:Password policy
    • Meta:Help:Two-factor authentication
      • Wikipedia:Using AWB with 2FA
    • Help:Reset password + Meta:Help:Account recovery
    • Help:Delete account - Wikipedia:Courtesy vanishing
  • Wikipedia:Compromised accounts + Meta:Help:Compromised accounts
  • Help:Login notifications
• Essays: Wikipedia:Essay directory#Privacy and security
• Digital Security Resources (Human Rights Team) (not consistently updated)
  • Should there be a prominent box at the top that says "The content of this page last went through a thorough review by staff on ___" to help editors know how recent this advice is?
• Wikipedia:Phishing emails - "This page is currently inactive and is retained for historical reference."
• MediaWiki:Protecting your digital identity - "This page is obsolete."

Account security features

• Product Safety and Integrity/Account Security (MFA)
  • MFA supports authenticator apps since ___
  • Mandatory two-factor authentication for users with some extended rights

Privacy policies

• Wikimedia Foundation Privacy Policy
• Wikipedia:Harassment#Posting of personal information
• Wikimedia Foundation Data Retention Guidelines

Privacy features

• Wikipedia:Revision deletion and Wikipedia:Oversight (Wikipedia:Requests for oversight): "Suppression removes edits which breach privacy or defame somebody."
• Trust and Safety Product/Temporary Accounts
• Product Safety and Integrity/Incident Reporting System

Anti-abuse

• Wikipedia:Child protection
  • Commons:Child protection (proposal) (Proposal has not have had active discussion in 13+ years; talk page notes that Commons is still subject to meta:Legal and Community Advocacy/Legal Policies#Office Actions)
• Product Safety and Integrity/Anti-abuse signals - generally protecting against bad actors and malicious bots, which can have editor privacy and system security implications
  • hCaptcha
  • Suggested Investigations

Plans and goals

• 2025-2026 Product & Technology OKRs (OKR=Objectives and key results)
  • Safety and Security (WE4): "Our systems better protect our editors’ accounts and private information by default, while offering more pathways for editors and users with extended rights to prevent and respond to abusive activity."
  • Product & Engineering Support (PES1): "20% of critical unowned services, according to a risk analysis framework, get owners committed by the end of Q4."
• Annual Plan 2026-2027 (draft): "For Users with Extended Rights (UWER), smarter automation (like suggested investigations into suspicious activity) can help reduce the repetitive moderation work often associated with an influx of new users, freeing UWER to focus on higher-impact tasks. We will also help protect user accounts with strengthened security."
  • Product & Technology OKRs: Engage - Safety & Security - "Objective: We protect our trusted volunteers and expand their capacity to deal with bad-faith activity, through signals and tools that make those volunteers more efficient, and platform-level automation that can help detect and contain bad-faith activity from the start."

Software development and operations

MediaWiki (core and extensions)

Should MediaWiki extensions be considered user-managed software in this context?

Responsible teams: Product Safety and Integrity, Wikimedia Site Reliability Engineering, MediaWiki Engineering Group, Developer Experience (includes Quality Services, Release Engineering, Technical Documentation, Test Platform)

• Security engineering practices, policies, and procedures: mediawiki.org/wiki/Security
  • Security for developers
    • Security for developers/Architecture
    • Security checklist for developers
  • SOPs - "Subpages here are generally maintained by the Wikimedia Security Team." (That Wikimedia Security team page is marked obsolete, but this page and the subpages are linked from mediawiki.org/wiki/Security. Are they obsolete or maintained?)
    • Security/SOP/Access to Phabricator Security Issues - WMF recently updated this one - "Major update published on June 29, 2026"
    • Security/SOP/Application Security Reviews (No updated date on the page; linked from several places including Writing an extension for deployment.)
    • Security/SOP/Requests For Service - "Last reviewed on: 10 January 2020" - linked from security.wikimedia.org/contact/ and Product Safety and Integrity
    • Security/SOP/Security Preview - "Review Required by: 1 July 2022 Revised on: 5 March 2020"
  • Also linked from sidebar on mediawiki.org/wiki/Security (Are these obsolete or maintained?)
    • Security/Guides/SQL Queries and 3rd Party Packages (Says "When in doubt, just get in touch with the Security Team", which goes to a page that is obsolete.)
    • Security Risk Management
    • Security/Training resources (Latest public resources are from 2018.)
    • Security/Application Security Pipeline
    • Security/Wikimedia Risk Calculator
    • Security/Phabricator Security Tags
    • Wikimedia Security Team/Third Party Code Review Checklist
• mediawiki.org/wiki/Category:Security
• MediaWiki development guidelines
• MediaWiki development policy
  • Gerrit/Privilege policy (Git repositories) - "This page documents an official Wikimedia development policy. There is no current mechanism to make changes, as the TechCom RFC process is defunct." (How big of a problem is it that the TechCom RFC process is defunct? Where are discussions about potential successors that would enable making changes to policies like this one?)
  • Wikimedia Engineering Architecture Principles: "To ensure the data integrity of the content on WMF systems, and protect the privacy of our users" — only collect data needed, prevent unauthorized access, reduce attack surface, resilience against data corruption, responsive as well as proactive in ensuring security, easy to change configuration settings
  • Wikimedia services policy#Security and privacy
  • Best practices for extensions#Security (Includes "TODO: Should extensions be creating user groups in their default configuration?")
• Policy:Wikimedia Foundation API Usage Guidelines
• Developer docs and guides
  • Writing an extension for deployment
  • Help:OAuth + OAuth/For Developers
  • Manual:Bot passwords
  • Cross-site request forgery
    • Manual:Edit token "The information on this page needs to be verified by a developer."
  • Cross-site scripting + DOM-based XSS
  • Manual:MIME type detection
  • SQL injection + Manual:Database access
  • Manual:Security - mainly for people deploying their own MediaWiki instances
• Handling of security issues and vulnerabilities
  • Reporting security bugs
  • How to deploy code#Security patches - links to the obsolete Security Team page
  • Wikimedia Foundation/Contact us
  • Hall of Fame: "This page contains various people that the Wikimedia Security Team would like to give thanks to for responsibly reporting security issues."
  • Bug Bounty policy

• SRE (also on MediaWiki)- "The Site Reliability Engineering (SRE) team is responsible for developing and maintaining Wikimedia's production infrastructure. We ensure that all of Wikimedia's public-facing sites and services (including MediaWiki and all associated services) run reliably, securely, and with high performance."
  • SRE/Production access
  • Acknowledgement of Wikimedia Server Access Responsibilities
  • Incident response/Runbook
• Planning and prioritization of security work
  • How many open security tasks are unaddressed in Phabricator?
    • ~1000 as of Oct. 2025
• Security features
  • Shellbox - "primarily implemented to sandbox LilyPond (used by the Score extension) and provide a way for MediaWiki to utilise external binaries without needing to run them in the same container"

Data Platform

Responsible team: Data Platform

• Data Platform Engineering
  • Data Platform/Data access - "allows a restricted, carefully-vetted set of users to perform research and analysis on confidential data (such as the IP addresses of readers and editors). This private data is stored according to our privacy policy and data retention guidelines."

Product Analytics

Responsible team: Research and Decision Science

• Product Analytics
  • Product Analytics/Superset Access

Machine Learning

Responsible team: Machine Learning

• LiftWing - Inference Services + Deploy

Fundraising

Responsible team: Fundraising Tech

• Fundraising/Internal-facing/CiviCRM - "WMF fundraising uses CiviCRM to track donor data."

Apps

Responsible team: Wikimedia Apps

• iOS app
• Android app

IRC - community

Responsible team: ?

• IRC - docs page for community discussion channels
• Channels - mostly on Libera Chat - How do users with extended rights keep their internal discussions private?
• WikiLounge (WMCS-based IRC web client and bouncer) - "WikiLounge is powered by the open-source The Lounge software. It was deployed and is currently maintained by ZI Jony as a tool to improve the communication experience for Wikimedia volunteers."
  • WikiLounge#Privacy Policy & Security Disclaimers - "Because the operators of this WikiLounge instance do not have the same level of access or confidentiality obligations as Stewards, CheckUsers and Oversighters, users with CU/OS-level access should carefully consider whether this service is appropriate for their work." "As with any TheLounge installation, server administrators and WMCS Sysadmins have access to data stored or processed by the service, including: Private messages and channel messages."

IRC - infrastructure

Responsible team: SRE

• irc.wikimedia.org - "a IRC service for broadcasting recent changes events from public Wikimedia Foundation wikis."
  • "Interruption in this service will cause projects to suffer damage in the form of vandalism that will go largely unrecovered or cost significant volunteer efforts to fix retroactively."
  • "We now have a a vastly superior EventStreams service...but until the key consumers of the IRC recent changes feed have migrated, this old service remains vital."
  • "While it is most unfortunate that we rely on a bot to undo vandalism that should probably be prevented before saving (e.g. some kind of hook in AbuseFilter to consult ClueBot, could be ran natively on the cluster perhaps one day), and it is most unfortunate that most of our patrolling efforts indirectly rely on irc.wikimedia.org, that is the reality and it is important that we know its impact and the kind of sensitive treatment it deserves." Is this still true? Page was last updated in 2024.

The following pages may be obsolete, although they're not marked obsolete?

• Subpages of the former Wikimedia Security Team:
  • Wikimedia Security Team/Third Party Code Review Checklist - linked from sidebar nav template (Template:Security sidebar) and Writing an extension for deployment
  • Wikimedia Security Team/Charter
  • Wikimedia Security Team/Council
  • Wikimedia Security Team/Documentation
  • Wikimedia Security Team/Services
  • Wikimedia Security Team/Volunteers
  • Wikimedia Security Team/Strategy
• Security/Policy
  • Security/Policy/Candidates
• MediaWiki developer guidance
  • Security/Guides/Draft/Golang Security Best Practices (marked as a draft)
  • Help:Security/PDF files
  • Help:Security/SVG files
  • Security Notes on Remote Embedding
  • XML External Entity Processing

User-managed software

Security/SOP/Application Security Reviews: "Code not likely to be reviewed: [...] Applications running under Cloud VPS or Toolforge, even higher-visibility applications like Quarry; Any user-JavaScript or Gadgets which may run on various Wikimedia wikis."

Wikipedia:Interface administrators: "Interface administrators (interface-admins) are users who can edit all JavaScript (JS), Cascading Style Sheets (CSS), and JavaScript Object Notation (JSON) pages in the MediaWiki and User namespaces."

• 2024/2026 Signpost essay arguing that interface administrators should not have these privileges

User scripts

• Wikipedia:User scripts - "User scripts have unlimited access to your account by their very nature – unlike OAuth/bot password based applications such as Huggle, where you can control access levels, the script runs in your browser."
  • Wikipedia:User scripts/Most imported scripts
• Product Safety and Integrity/Account Security/Securing User-Managed Code
  • Any information on if/when maintainers of User-scripts will be required to have MFA?

Gadgets

• Gadgets - "Since Gadgets reside in the MediaWiki namespace (the list defining the gadgets as well as the actual code snippets), only sysops (interface admins from 1.32) can edit the code. This is as it should be: only users especially trusted by the wiki community should be able to edit JavaScript code used by other users since JavaScript can easily be used to hijack accounts or spy on people."

Tools (Toolforge and Cloud VPS apps)

• Help:Toolforge/Toolforge standards committee: "a group of Wikimedia volunteers who review, approve, and facilitate access requests for the source code of Toolforge hosted tools, and adoption and usurpation of abandoned tools"
  • Security issues: "If a vulnerability is found, it should be reported on Phabricator using the security form."
  • Are there security standards for tools on Toolforge and Cloud VPS?
• Product and Technology Advisory Council/Unsupported Tools Working Group
• Wikitech:Cloud Services Terms of use
• Wikimedia Cloud Services team/Incident response process

Example set of applications on Cloud VPS: Countervandalism Network

Standalone projects

• New Developers: Choose a software project - Kiwix, Commons App for Android, Wiki Education Dashboard, Pywikibot, Scribe, VideoCutTool

Documentation

Responsible team: Wikimedia Technical Documentation Team

• T319318 Task about restructuring security-related docs, closed as resolved in March 2026

Wikimedia Foundation

Responsible teams: Wikimedia Site Reliability Engineering, Product Safety and Integrity?

• What tools/techniques are used to train employees to avoid phishing and other cyber threats?
• Are there any that have not been implemented but have been or are being considered?
• What is the security budget each year for the last 3 years? (as a dollar amount and as a percentage of Wikimedia Foundation's overall budget)
• How does security compare to security at Mozilla? Other peer organizations?
• Have there been any recent audits of the security strength of Wikimedia? (If so, what were the findings?)

Is the information at security.wikimedia.org outdated, since the Wikimedia Security team seems to have been renamed Product Safety and Integrity?

• This Phabricator comment says "I guess this begs the question of whether security.wikimedia.org is still necessary. There are some pages there (hall of fame, bug bounty policy, etc) that probably need to be preserved somewhere."

Incidents

• January 2014 zero-day vulnerability discovered by Check Point and patched
• November 2016 staff and community compromised accounts
  • Wikitech-l explanation - "We're fairly sure now that their mode of operation involves searching for target admins in previous user/password dumps published by other hackers, such as the 2013 Adobe hack."
  • Incident summary on Wikitech
• September 2019 DDOS attack took Wikipedia offline in parts of the Middle East, the UK, Poland, France, Netherlands and Germany.
  • Signpost coverage (with March 2020 followup)
  • Craig Newmark donated $2.5m to improve security
• June 2022 MariaDB password leak - "While the incident broke an important security boundary, other boundaries (specifically, firewalls) prevented data compromise."
• March 2025 discovery of account compromises: "we believe this unauthorized activity is most likely the result of user passwords becoming compromised through users reusing their password on a compromised website, or logging into Wikimedia projects from a compromised device."
  • Signpost coverage
• March 2026 user script incident
  • Wikimedia Foundation/Product and Technology/Product Safety and Integrity/March 2026 User Script Incident + FAQ
  • Signpost coverage:
    • Security testing unleashes computer worm on Meta-wiki
    • What actually happened during the Wikimedia security incident?
    • Opinion, republished from 2024: Interface administrators and trusting trust

How close are the topics 'List of Wikimedia security incidents' or 'Security of Wikimedia projects' to notability for a standalone mainspace article or a section in an existing article?

• The secondary coverage seems mostly WP:CORPTRIV

Editor forums

Related forums for editors to better understand and collaborate on security projects

Discussion of technical topics

• Wikipedia:Village pump (technical)
• MediaWiki Support desk - "ask any questions you have about installing, using or administrating the MediaWiki software"
• Wikipedia:IRC
• Wikipedia:Discord
• Wikipedia:Mailing lists - Wikitech-l

Editor help content

• Wikipedia:Help Project

Article content

• Wikipedia:WikiProject Computer Security (for Wikipedia articles/sections of articles about security incidents)
• Wikipedia:WikiProject Wikipedia (for Wikipedia articles/sections of articles about security incidents)

MediaWiki technical volunteers

• Wikimedia Security Team/Volunteers marked as obsolete (for trusted technical contributors who have signed NDAs)

• This is currently managed through acl*security_volunteer and acl*security_steward

• Product and Technology Advisory Council

Opportunities for editors to help

• Improve information pages and essays about account security: Category:Wikipedia user account security
• Improve security-related articles that we link to (or could link to) from Wikipedia docs, such as:
  • Password manager
    • 1Password - linked from Meta:Help:Two-factor authentication
  • Multi-factor authentication - linked from Meta:Help:Two-factor authentication, along with the following articles:
    • Google Authenticator
    • Microsoft Authenticator
    • FreeOTP
    • Comparison of OTP applications
    • YubiKey
    • Nitrokey
    • Titan Security Key
  • WebAuthn (Passkey redirects here)
• Give thanks or even barnstars to editors who have made significant contributions to securing Wikipedia (e.g. The Defender of the Wiki Barnstar, The da Vinci Barnstar, The Technician's Barnstar, The Scripting Barnstar, The Detective Barnstar, The Barnstar of Diligence, The Tireless Contributor Barnstar, The Original Barnstar)

Should there be a new dedicated space for editors to go to discuss the security of Wikipedia?

• Task Force/WikiProject?
  • Since the task force model is scoped to improving article content, I think this type of project needs a different model. Dreamyshade (talk) 03:31, 27 June 2026 (UTC)
    • Would you recommend a standalone WikiProject? Superb Owl (talk) 05:09, 27 June 2026 (UTC)
      • The WikiProject model also seems to be content-focused. Maybe you could start by writing down things you have in mind for an editor forum, like goals and intended activities? Might be interesting to ask the Product and Technology Advisory Council what they think. Dreamyshade (talk) 05:21, 27 June 2026 (UTC)
• Discord thread on the meta channel? technical channel?
• Signpost column?