Overview
- Bitcoin Core merged the policy change on Thursday, October 22, when developer Antoine Poinsot added an “easily discoverable” classification to the security disclosure rules.
- The new label covers bugs that can be found with minimal effort, for example with a simple prompt to a large language model, and those bugs must be fixed and disclosed immediately.
- Fixes for easily discoverable bugs will be shipped as point releases for every maintained major version and published with a security advisory.
- Other vulnerabilities still follow severity-based embargo timelines and critical flaws will use an ad-hoc process outside the standard policy.
- The project only supports the latest three major versions (currently 31.x, 30.x and 29.x), version 28.x is end-of-life, backports depend on volunteer capacity, and node operators are advised to run the newest maintained release because point fixes will reach users faster but with less testing time.