Bitcoin Core has formally ended its longstanding practice of quietly shipping certain security fixes without public disclosure. The reference implementation used by most full nodes on the Bitcoin network is adopting a structured vulnerability reporting policy that requires security issues to be documented and made publicly available after a defined waiting period following a patched release.
The shift follows an AI-assisted security review in which researchers flagged 4,962 potential issues across Bitcoin projects. Developers are now accelerating fixes for easily discovered vulnerabilities while weighing new tradeoffs between speed and testing. The policy categorizes flaws by severity: low and medium severity issues become public two weeks after a patch release, high severity bugs carry a longer embargo to give the network time to upgrade, and critical vulnerabilities are handled case-by-case with no fixed disclosure window until risk subsides.
Under the previous informal approach, serious bug fixes were sometimes merged into releases without any accompanying public notice, leaving node operators unaware that a vulnerability had existed or been corrected. With roughly 20,000 reachable full nodes on the network, the lack of security context made it harder for operators to prioritize upgrades. The policy aims to give exchanges, custodians, and infrastructure providers a predictable disclosure timeline for security patch management.
Bitcoin Core contributors also noted that the old system created an information gap: independent researchers who discovered known-but-undisclosed bugs had no official channel to confirm whether Core was already aware. The new framework provides a documented reference for downstream Bitcoin implementations and forks that track Core’s codebase. Disclosures occur only after a fix is available, preserving embargo periods to avoid handing attackers a roadmap before the network has patched.
The immediate test of the new framework will be how Core handles the first high-severity disclosure under the new rules. Node operators and developers are advised to monitor the official Bitcoin Core security advisories page for new entries as patched versions ship.
