Bitcoin Core to Disclose Vulnerabilities Easily Found by AI Immediately

Bitcoin Core has adopted a new vulnerability disclosure policy under which security flaws that can be easily discovered with AI will be made public at the same time the fix is released. With AI now finding security holes so easily, the project concluded that keeping them under wraps for long no longer benefits users. The policy document states that "the embargo period offers little gain while only delaying the availability of fixed distributions."

The difference between the new policy and the existing rules lies in the disclosure timing. Until now, low-severity vulnerabilities were disclosed two weeks after the next major release, while medium- and high-severity ones were disclosed two weeks after the end-of-life (EOL) of the last affected version, up to a maximum of one year.

Critical bugs are excluded from the standard policy. These are flaws that could enable coin theft, inflation of the supply, or a permanent chain split.

There was some disagreement during the revision process: developer Antoine Riard called for an option to release fixes without advisories, but Antoine Poinsot rejected it.