Bitcoin Core has updated its vulnerability disclosure policy, saying large language models have made some flaws easy to rediscover. Developer Antoine Poinsot said lengthy embargoes can delay fixed releases while offering little protection in those cases.
Flaws deemed “easily discoverable” will receive fixes as soon as possible across all maintained major versions, with advisories published alongside the updates. Other flaws will still follow severity-based disclosure schedules: low-severity flaws will be disclosed two weeks after a major release containing the fix, while medium- and high-severity flaws will be disclosed two weeks after the last affected release reaches end of life. Critical bugs fall outside the standard policy and would likely require a separate procedure.
