Found and Fixed Before It's Public: Core Lightning's 14-Day Disclosure Gamble
“Don’t trust, verify.”
Easy to say.
Harder when verifying immediately might help the attacker.
Core Lightning confirmed that some of the recent AI-generated vulnerability reports describe real issues.
Their response creates an unusual trade-off:
signed binaries first, source code and vulnerability details 14 days later.
Why?
Because a security patch isn’t only a fix.
It’s also a clue.
Diff the vulnerable and patched code and you can start asking exactly where the old version was wrong. Now give AI the same diff and that analysis gets cheaper and faster.
So for two weeks, CLN operators can verify the signature — but not yet fully verify the code behind the fix.
I don’t see this as abandoning “don’t trust, verify.”
I see it as a much harder question:
What exactly should we verify when immediate transparency increases the attack surface for everyone who hasn’t upgraded yet?
I went deeper into the disclosure model, AI vulnerability triage, --offline, reproducible builds and what we should check when the embargo expires:
https://davidebtc186.substack.com/p/found-and-fixed-before-its-public
Write a comment