I wrote:
This sort of thing really doesn't need to be reported to wikitech-l. There are transient bugs in the trunk all the time, we make no guarantee about its security or stability. Any security problem on Wikipedia can be fixed in a few minutes by reporting it by private message on IRC.
Further to that, I would appreciate it if Nick would commit his testing scripts to SVN, and document them fully. It would be easier if we could do this testing before we commit, rather than go through all this rigmarole.
-- Tim Starling