“This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”
How it works
Core can now flag a bug as easy to discover during triage, which in practice means one that “can be found with a simple prompt to an LLM.” Those bugs get a fix copied back to every version Core still supports, shipped in a point release “as soon as possible” along with a security advisory carrying some details.
“For these issues that are easy to find, this is the wrong tradeoff,” the policy reads of the old embargo. “The embargo period achieves little but it delays the availability of a fixed release.”
Fixes “won’t have as much ‘bake time’” in testing before they reach users, however, Poinsot wrote.
Not every developer agreed on how far to go. Antoine Riard, a longtime bitcoin security researcher, wanted Core to keep the option of shipping a fix without an advisory and holding…
