Bitcoin's Red Team started as an emergency response to the Coldcard disaster.
Less than 3 days later: 24 people, 425 projects scanned, ~6,700 findings, and 1,029 classified as high or critical. Moving at 7.7 projects per hour.
But the real bottleneck isn't discovery. It's disclosure.
Only ~19.5% of scanned projects had a SECURITY.md. Only ~13.1% listed a security email. By hour 55, the team had produced thousands of findings but had only contacted ~130 projects. The scanners move at machine speed. Responsible disclosure is still hunting around for an email address.
@OpenSats stepped up and gave the effort a home. Code RED will prioritize support for red-teaming critical Bitcoin software and reimburse past LLM token costs. The dedicated Red Team Fund is live.
This week exposed how cheap vulnerability discovery has become and how unprepared most open-source projects are to receive the results.
If your code touches bitcoin, publish a security contact. If you can reproduce and triage findings, the Red Team needs you.
Less than 3 days later: 24 people, 425 projects scanned, ~6,700 findings, and 1,029 classified as high or critical. Moving at 7.7 projects per hour.
But the real bottleneck isn't discovery. It's disclosure.
Only ~19.5% of scanned projects had a SECURITY.md. Only ~13.1% listed a security email. By hour 55, the team had produced thousands of findings but had only contacted ~130 projects. The scanners move at machine speed. Responsible disclosure is still hunting around for an email address.
@OpenSats stepped up and gave the effort a home. Code RED will prioritize support for red-teaming critical Bitcoin software and reimburse past LLM token costs. The dedicated Red Team Fund is live.
This week exposed how cheap vulnerability discovery has become and how unprepared most open-source projects are to receive the results.
If your code touches bitcoin, publish a security contact. If you can reproduce and triage findings, the Red Team needs you.
42❤️4👍1🤙1
