Review Policies

In order to protect the safety and sovereignty of Firefox users, Mozilla requires all add-ons to comply with a set of policies on acceptable practices. The exact set of applicable policies varies depending on a number of circumstances, the most important being whether the add-on is hosted on addons.mozilla.org (hereafter AMO), and how the add-on is distributed in the wild.

This document outlines the policies which different classes of add-on are expected to obey. Regardless of the class of add-on, these policies are enforced via a mandatory review process facilitated by AMO, and a mandatory code signature check, enforced by Firefox.

Add-on Review Tracks

Listed on AMO

Add-ons listed on AMO must undergo review by a human reviewer. Prior to review, add-ons are accessible to users who have a direct link to their listing pages, but are otherwise hidden from the public. Once approved, these add-ons have a public listing page including screenshots, descriptions, and user reviews; the listing appears in search results, collections, and occasional promotions. Existing users  automatically receive updates to new versions published to AMO.

Listed add-ons undergo full code review, as well as functional testing. These add-ons are subjected to a high quality bar.

Unlisted

Unlisted add-ons must be uploaded to AMO prior to distribution, but are otherwise not accessible to the public via the site. These add-ons must be distributed elsewhere by their publishers. Depending on the manner of distribution, unlisted add-ons undergo a fully-automated review, with possible post-signing code reviews.

While these add-ons are automatically signed, they are held to very similar standards to those of listed add-ons. The primary difference is that these add-ons must manage their own updates.

Policies

The following table outlines the primary policies which apply to each add-on review track. The policies are explained in further detail below. The symbols below each review class specify how the requirement applies to those add-ons as follows:

Security

Because add-ons run in an environment with elevated privileges relative to ordinary web pages, they present a very serious set of security considerations. They have the potential to open security holes not only in the add-ons themselves, but also in the browser, in web pages, and in particularly worrying cases, the entire system the browser is running on. As a result, we take our security policies very seriously, and apply most of them to all add-ons, whether hosted on AMO or not. We expect all add-ons to be secure, not only in their handling of their own data, and of user data, but also in all of their interaction with the web, the browser, and the operating system.

Privacy and User Consent

We take user sovereignty and privacy extremely seriously. Whether hosted on AMO or not, we require all add-ons to respect users choices and their reasonable expectations of privacy. In particular, this means that add-ons may not limit users control of their browsers, by making it impossible to permanently change settings (such as the homepage or search engine), preventing users from uninstalling them, hiding their presence from users, or installing toolbar buttons or other UI elements which cannot be permanently removed via the UI customization process.

Features like advertising or certain forms of user activity tracking may be required to be opt-in, or at least opt-out, depending on the privacy and security impact, and whether the feature is necessary for the add-on to function or not. Since these are usually additional monetization features that are unrelated to what the add-on is meant to do, they generally require an opt-in for listed add-ons and an opt-out for unlisted ones. Some forms of tracking, like gathering all visited URLs, are generally forbidden even for unlisted add-ons. The decision to activate or deactivate these features and its implications must be clearly presented to the user.

User Experience

We expect all add-ons to work without significantly degrading users' experience with the browser. In particular, add-ons may not adversely affect browser performance, break built-in features, or damage the user interface. For add-ons listed on AMO, we likewise expect a consistent generally positive user experience for any functionality provided by the add-on.

Content

While we have no interest in controlling the types of functionality provided by add-ons in the wild, there are certain types of content that addons.mozilla.org cannot host. In particular, all content hosted on the site must conform to the laws of the United States, and comply with the Mozilla Conditions of Use.

Technical

We try, as much as possible, not to restrict the freedom of developers to maintain their add-ons as they choose. However, for reasons of security and our ability to effectively review code, we do have certain technical requirements. In particular, potentially dangerous APIs, such as those which evaluate HTML or JavaScript, may only be used in ways which are provably safe, and code which we cannot verify to behave safely and correctly may need to be refactored.

Source Code Submission

Add-ons may contain binary, obfuscated and minified source code, but Mozilla must be allowed to review a copy of the human-readable source code of each version of an add-on submitted for review. In such cases, the author will receive a message when the add-on is reviewed indicating whom to contact at Mozilla to coordinate review of the source code. This code will be reviewed by an administrator and will not be shared or redistributed in any way. The code will only be used for the purpose of reviewing the add-on.

Instructions for reproducing obfuscation are also required, please read the details of this guideline to ensure a swift review.

If your add-on contains code that you don't own or can't get the source code for, you may contact us for information on how to proceed.

Reviewers

Add-ons are reviewed by the AMO Reviewer Team, a group of experienced add-on developers that volunteer to help the Mozilla project by reviewing add-ons to ensure a stable and safe experience for users. The Reviewer Guide details how reviewers evaluate add-ons submitted for review. It is an expanded version of the table shown above. Developers will receive an email with any updates throughout the review process. Review times can fluctuate depending on reviewer availability and the complexity of the add-on being reviewed. Regular updates of review queue status are posted in the Add-ons Blog.

Blocklisting

Add-ons that don't meet the bar for Unlisted may qualify for blocklisting, depending on the extent of their problems. The Add-ons Team will do their best to contact the add-on's developers and provide a reasonable time frame for the problems to be corrected before a block is deployed. If an add-on is considered malicious or its developers have proven unreachable or unresponsive, or in case of repeat violations, blocklisting may be immediate.

Guideline violations should be reported via Bugzilla, under Tech Evangelism > Add-ons. Questions can be posted in the #addons IRC channel.