Get a security review.

[biancadanforth]

As part of a more rigorous review process for landing shield studies (currently modeled after this), this study should receive a security review.

This is a meta-issue for any security-related concerns.

Security reviewer: mozfreddyb

Here is the Security review document with recommendations.

Additional recommendation(s):

• Ensure any dependencies that ship with the addon are listed in package.json as "Dependencies", not "devDependencies". Example: ShieldUtils.jsm. #78
• Sanitize data passed between privileged scopes before inserting into HTML #90

[biancadanforth]

Closing this issue; the review states that the overall security risk is low, and after following up with @mozfreddyb, the only blocker is reflected in an existing P1 issue: #90 .