Bitcoin Core updates security policy for bugs easy to rediscover

Bitcoin Core has updated its security policy to create an “easily discoverable” category of vulnerabilities, changing how quickly certain flaws are fixed and disclosed. For people who run Bitcoin nodes, the practical effect is that patches for this category should reach supported software versions sooner, though developers say the accelerated process allows less testing time.

The Bitcoin Core security policy update calls for fixes to be backported, meaning applied to older software branches that are still supported, and released in point updates as soon as possible. Each release will come with a security advisory rather than a prolonged embargo, according to CoinDesk and Unchained.

How does Bitcoin Core’s new security policy work?

The new designation applies to vulnerabilities that can be found with minimal effort. Maintainers expect it will often cover flaws that a large language model, or LLM, can identify with a simple prompt, but the category is not limited to bugs initially found with AI, Unchained reported.

For those issues, Bitcoin Core plans to issue a patched point release for every maintained major version and publish an advisory alongside it. A point release is a smaller software update within an existing version line, typically used for bug and security fixes.

The project previously used disclosure schedules tied mainly to a flaw’s severity. CoinDesk reported that low-severity issues were disclosed two weeks after the next major release containing the fix. Medium- and high-severity issues stayed private until two weeks after the last affected release was no longer supported. Critical vulnerabilities were handled individually.

Those standard severity-based rules remain for issues outside the easily discoverable category, according to Unchained.

Why did Bitcoin Core change the disclosure process?

Antoine Poinsot, a Chaincode Labs developer who proposed the change, said the project had received more reports of vulnerabilities that could be readily rediscovered. He attributed that increase largely to LLMs lowering the effort needed to find some types of problems or to spot a quietly shipped fix, according to Decrypt.

The revised rule reflects a narrower judgment about disclosure: if an attacker could readily locate the weakness, withholding details for months may postpone a usable fix without providing much protection. Poinsot said a covert patch offers little benefit for this class of issue because an LLM scan may uncover the flaw and broad backporting can itself reveal where developers made changes, Unchained reported.

There is a cost to moving faster. Poinsot said expedited patches will have less “bake time,” or time for testing in development before users receive them, CoinDesk reported.

What the change means for node operators

A node is software that validates and relays Bitcoin transactions. Operators of maintained Bitcoin Core versions may need to assess and install point releases sooner when the project identifies an easily discoverable vulnerability. The new process does not promise a fixed timetable beyond releasing patches as soon as possible.

The policy was debated among contributors. Security researcher Antoine Riard favored preserving an option to release a fix without an immediate advisory in some cases. Poinsot opposed alerting users without details, arguing it could create unnecessary risk by prompting rushed migrations, CoinDesk reported.

The discussion follows increased attention to AI-assisted security research. CoinDesk reported that a 16-person volunteer group called the Bitcoin Red Team reviewed 390 Bitcoin projects in late July and logged 4,962 findings, including 85 it characterized as critical. Those figures describe the group’s findings, not confirmed vulnerabilities across every project.

This story draws on original reporting from Decrypt.