From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Thu, 22 Oct 2026 11:14:40 -0700 Received: from mail-oo1-f57.google.com ([209.85.161.57]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1xJxJI-0003Op-9H for bitcoindev@gnusha.org; Thu, 22 Oct 2026 11:14:40 -0700 Received: by mail-oo1-f57.google.com with SMTP id 006d021491bc7-702e606a1fdsf44236eaf.2 for ; Thu, 22 Oct 2026 11:14:39 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1792692874; cv=pass; d=google.com; s=arc-20260327; b=M6o1H8wnQq8hWs3KM8A2gVSwmmBnWP7Dzuv0sr0/wKvFLqQC54wgpsgT6/yVM04dv7 LZk9yqceUmCZ4VP8i5fWIWXlLN1mWS98LzGEQF2vEmAk6d6xVG9WLR9++afxRy4R7VxJ KT4ftvBZHzEHUNFz80RI9uSRQFYIeMQWJvoMuSIrAWKU5XyhObuyiIMdlXT1XbAfgD9f J6uhSNor5EIcauqtwDKbxlOhhifk3tyBd+49Jl8Uant88gLNc+7Ip4N8uGxjHGAKSAHz E3j+l0ZDABw32Bt34EAavs1XkDLeFqU/ZF1zIoowA3KaznnrP7tHagZp5WtgF0WsRdub /VKA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:content-transfer-encoding :mime-version:feedback-id:message-id:subject:from:to:date :dkim-signature; bh=Q6JJXp6LGA4QP0z1cuLCFjN/0y9zsrz2r1l4fFVerxU=; fh=zxyXtGKXe50qlTF1REfFkkCrkgC2yQubX7F+o85E7Lw=; b=Iyu/FYfOPKTRUplgV7oifmwVCSjbX0vkMWtjhIPeR9O5LMaXh0pC/M/2FjmMkW8eNO Utj7LPEz2Hc/7QVy0D7QcFRFinR9k66BfFBp5BWVZrD9C6QXSkZLx9q40hheRfl9jCB0 TNVm2UMDlDlGyIovWkabRPp3C+r/tV0hkatdRF11+ERfBf0OWRB7YX6gVkg1pTwlu/I+ vLFYBkDk8s4NXBaKBXxxaCHSGVKqthy6Ud+cEGDYEqbDPdle3FTs/HlQ0YjgFZvyQDBX Zw9Sek+wf/oixp+PdV7QcEsyu04xdSh0AJFA/cybbOcUFebkLSBCxg51/minULJVKVtw uw+g==; darn=gnusha.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=xvpFRwwz; spf=pass (google.com: domain of darosior@protonmail.com designates 185.70.43.102 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1792692874; x=1793297674; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender :content-transfer-encoding:content-type:mime-version:feedback-id :message-id:subject:from:to:date:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Q6JJXp6LGA4QP0z1cuLCFjN/0y9zsrz2r1l4fFVerxU=; b=nZUCmWUfpBbVdjI0gP/wyFcpgiVvudOWrQWX6HrSy4+74Xyo9O2SXzBpOurcs/KOT7 5ynDGQf2H8vmDq6LlIVNNIIyabcIT29dY+Maq9XmvA1E44K3pjY8QFyf+gGjIQ9WRztE a/mQMMejTragpay45kekQ/EUeX2pn0AMC7Z/wBxdoAnRqT3gfpEVQ82L1m568QyxFTYF /gdtnrmG0B5zwAVQ2Qc3G9XoZDwwVb18B4TSH48C1IiOxDEACmj+/MPqh11DXjXxHTSm jMbZq2a1cG2PrGzy3yKGdz/gnYNn/Qv321HJM/cYNh/j73dLqp7xvRbRmlPg+NVceWiP LvfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792692874; x=1793297674; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender :content-transfer-encoding:content-type:mime-version:feedback-id :message-id:subject:from:to:date:x-beenthere:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Q6JJXp6LGA4QP0z1cuLCFjN/0y9zsrz2r1l4fFVerxU=; b=mIN79SucRt5wgpgcvsbXbxsculqV0l8DSfom+zfmaJ4jY7je5kdRrPXjD9T3hA2k+G l4NlzsG3sadsQSQLScX+m2S63z+cJUfPVEOjgdiYlbhZJBjf1jwgnCvy8HqKjz2tiEN5 bhwI+tL2L/vZTihAqQl7ngtiDeQF4Ub+bBg8kYvQyJJh+GQcuvnbIOX8nhPzmZYmKBiM /DWmN9Ngp2qnfJag7fQ0Hwg7RiCJE5LsJbUqHOumeRDTC9X6mVsK3d8N7hItIUlj25LD M90BFsE6n2DLTsmvBPx48Isi7PevyvZLAXch0wRticIH/P4sna6pBwYzYSW/+I3xCOnD nWvA== X-Forwarded-Encrypted: i=2; AKwUvBwIp6qbgkH4n0t1BBqne/1oLxyLMFK152xjiKWgXiSBFlEvZSHiwpcbnj8gq0JJ8N38epYArU5V3TFO@gnusha.org X-Gm-Message-State: AFq9FYJaDN+4YXQMiISdEBKI0UCUOD8nzDX+uiA5qSvljy2/a01TOI96 v/ZoH14lUqklzmkCQhFhvQYbA/v4yMQAl9xVAqe7w7Ce2Svr8L6rpc5h X-Received: by 2002:a05:6820:258d:b0:6b1:bb82:f7a3 with SMTP id 006d021491bc7-70b887fb63fmr150902eaf.5.1792692873889; Thu, 22 Oct 2026 11:14:33 -0700 (PDT) X-BeenThere: bitcoindev@googlegroups.com; h="ATskLddWqruZVCoZW7X+RkLjACFkByzq9d/CfNQhORd2bn6BMQ==" Received: by 2002:a05:6820:3514:20b0:70b:64c1:dbdc with SMTP id 006d021491bc7-70b8955b965ls6914eaf.1.-pod-prod-04-us; Thu, 22 Oct 2026 11:14:27 -0700 (PDT) X-Received: by 2002:a05:6808:13c6:b0:53a:e153:e8e7 with SMTP id 5614622812f47-5535d3dc7e7mr4625792b6e.44.1792692867702; Thu, 22 Oct 2026 11:14:27 -0700 (PDT) Received: by 2002:a05:6402:a593:10b0:6b3:874e:2062 with SMTP id 4fb4d7f45d1cf-6b431e89efamsa12; Thu, 22 Oct 2026 11:07:22 -0700 (PDT) X-Received: by 2002:a17:907:cd07:b0:c40:b59:1b with SMTP id a640c23a62f3a-c4679a0ad6cmr671629466b.44.1792692440734; Thu, 22 Oct 2026 11:07:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792692440; cv=none; d=google.com; s=arc-20260327; b=n9WnX6rATGOx3yxTc+QBAqCfrHM+VhUXIBc3b184MYvWoELd8y+PX+VLap49g7NQPt k9RIB3SIUYTe0XDAXwGt6U/jgPBrVUbJw2TttpoVNujNRp2Ym7vC1XmQM2D+kGwR4+Z0 uEIEmQuTPlhy/dn3jSD4bXxllMcA9MQKPEoomRQyfDs2WNlNpPETKyZhWnJhMxNsmtC4 y1zWb4UipVUxf6iNUjBmqZeZbYosEVyvfHIhdxHIDbwaJeifOJTmKTOaEtFh+EMpDWOt n5pACEJmh0FZFPiPa90Nel1A+qkG8gCEDJ2d+YDMt7cP8QXQhbxib61KIdWCdzrB3SAG VdYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:feedback-id:message-id :subject:from:to:date:dkim-signature; bh=/VE81hkXWQtSH4v+Jh+MH2SDXfsuHPTz4Xaabxo9NoY=; fh=DMP0F9ULS1guKiqimntQRCN8ZraraesEgQuVcn7F0Z0=; b=aZQD2TgiWXXearqKzI7Y02T/Glh7sIj558wZV0LEWGWnvOmn0dP3Ug4KX8nchGOJLw U8NN7nRLc3+zoDLcGo5TcgMtb6nqNu0CSsgQTumdo2WIyBcI4PjZrIUp6UrWM1UxmyuV HulJVpCyt1cg6E07RRNN0pVoDhHqmHSuk1S8yK0b+vPaUpUXcyxRbQ9rukHZMs50U8W4 tamtndurUgQIsCijNuCNukbdZTR09BniO0dAPEAaIJjnIyaz8zSxivWC3Ktc62thCkhK XYGvn71/YkcIHgZ1sxY0Rd+SKQNnbNX0l37YRxELlrckid0w9R2aV+UDzS0bf0xYZGLi fGQw==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=xvpFRwwz; spf=pass (google.com: domain of darosior@protonmail.com designates 185.70.43.102 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com Received: from mail-43102.protonmail.ch (mail-43102.protonmail.ch. [185.70.43.102]) by gmr-mx.google.com with ESMTPS id a640c23a62f3a-c46a5c83b17si433766b.10.2026.10.22.11.07.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Oct 2026 11:07:20 -0700 (PDT) Received-SPF: pass (google.com: domain of darosior@protonmail.com designates 185.70.43.102 as permitted sender) client-ip=185.70.43.102; Date: Thu, 22 Oct 2026 18:07:17 +0000 To: Bitcoin Development Mailing List From: "'Antoine Poinsot' via Bitcoin Development Mailing List" Subject: [bitcoindev] Bitcoin Core security policy update Message-ID: <1ehBdwhbU-1cUjU5SjRxn75XNUBvIfNbkfqPCJRFPlOfsBu5gHWotmNRNxcMirTl1baT2H-zBfJMeWM6rl-XJG8zV6gHf8vQ9b_TRB9vnIk=@antoinep.com> Feedback-ID: 7060259:user:proton X-Pm-Message-ID: f3eddd95ab88c73de7b24a2406fd6b7d5654d3ff MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Original-Sender: darosior@protonmail.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail3 header.b=xvpFRwwz; spf=pass (google.com: domain of darosior@protonmail.com designates 185.70.43.102 as permitted sender) smtp.mailfrom=darosior@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com X-Original-From: Antoine Poinsot Reply-To: Antoine Poinsot Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: -1.0 (-) Hi, We recently experienced an increase in the number of reports for security v= ulnerabilities that can be easily (re-)discovered. This is largely due to L= LMs drastically reducing the bar to find certain classes of issues or ident= ify covert fixes. Any security policy is going to make a tradeoff between two goals that are = in tension: transparency and giving users sufficient time to upgrade. Trans= parency helps level the playing field between attackers and defenders, but = can also make vulnerabilities public before users have upgraded. Because of the nature of our project, coupled with a slow upgrade culture, = our security policy favours a longer embargo period. This generally means s= ecurity fixes can't be backported, and only become available with users alo= ng with the next major release. For these issues that are easy to find, this is the wrong tradeoff. The emb= argo period achieves little but it delays the availability of a fixed relea= se. We are therefore updating our policy disclosure to accommodate those. During triage we may flag a vulnerability as easy to discover. In practice,= we expect those to be issues that can be found with a simple prompt to an = LLM, but the classification is not restricted to those. For such issues, we= will backport a fix to all currently maintained releases, and cut a relase= as soon as possible. We will publish some details in a security advisory a= long with the fixed releases. Our updated security policy is available at https://bitcoincore.org/en/secu= rity-advisories Antoine Poinsot --=20 You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/= 1ehBdwhbU-1cUjU5SjRxn75XNUBvIfNbkfqPCJRFPlOfsBu5gHWotmNRNxcMirTl1baT2H-zBfJ= MeWM6rl-XJG8zV6gHf8vQ9b_TRB9vnIk%3D%40antoinep.com.