Foundation.mozilla.org: Examine Optimizely integration & security

[xmatthewx]

@gvn - can you add a summary here? I don't think we need to start this work now, just want to make sure we capture the info. For later this month or next. cc @alanmoo

[gvn]

Fundamentally, Optimizely requires us to weaken our content security policy to allow inline script execution, which opens an attack vector.

Aside from that, it also allows code to be added to our sites (and directly to production) by anyone with Optimizely credentials that hasn't been given a proper review (although, we could set a policy to address that issue).

[kristinashu]

I believe we are no longer using Optimizely.

[gvn]

Good decision! 👍