Bitcoin Core security policy update

Hi,

We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered. This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.

Any security policy is going to make a tradeoff between two goals that are in tension: transparency and giving users sufficient time to upgrade. Transparency helps level the playing field between attackers and defenders, but can also make vulnerabilities public before users have upgraded.

Because of the nature of our project, coupled with a slow upgrade culture, our security policy favours a longer embargo period. This generally means security fixes can't be backported, and only become available with users along with the next major release.

For these issues that are easy to find, this is the wrong tradeoff. The embargo period achieves little but it delays the availability of a fixed release. We are therefore updating our policy disclosure to accommodate those.

During triage we may flag a vulnerability as easy to discover. In practice, we expect those to be issues that can be found with a simple prompt to an LLM, but the classification is not restricted to those. For such issues, we will backport a fix to all currently maintained releases, and cut a relase as soon as possible. We will publish some details in a security advisory along with the fixed releases.

Our updated security policy is available at https://bitcoincore.org/en/security-advisories

Antoine Poinsot