Ten days of maintainer time bought Core Lightning a two-week embargo on AI-found bugs

The asymmetry worth pricing sits in the intake rather than in the code. A machine-written vulnerability report costs its sender close to nothing; confirming one cost Core Lightning's small team and its outside contributors ten days of work on submissions arriving from multiple sources, inside a review that had already been running for several weeks ^[4]. That is ten days of the scarcest input in volunteer-maintained infrastructure spent on adjudication, and therefore ten days of review and release work that did not get done.

The embargo then extends the operator's clock well past the maintainers'. Ten days of triage already spent plus at least another fourteen of withheld detail comes to at least twenty-four days ^[12] during which node runners are asked to act on a hazard whose size has not been published ^[3].

The other half of this is distribution. On August 26 the developer calle posted a red alert relaying that Blockstream developers were telling users to shut their Core Lightning nodes down immediately ^[7]; the project's correction, dated August 27, said operators did not need to shut down and should install the release promptly rather than eventually ^[8], and it carried 29 reposts and 61 likes as counted by Cryptopolitan ^[9]. The release will have signatures an operator can verify ^[2]. The instruction about the release carries no such signature, and it has to out-travel the loudest post in the channel.

August already supplied the precedent: BTCPay Server shipped an emergency patch early in the month after attackers used a flaw to steal LND macaroon credentials ^[10], and that project's own read was that the tooling cuts both ways, making bugs cheaper for defenders to find and large open-source codebases cheaper for attackers to skim ^[11]. There is a counter-view here worth naming directly: two weeks is ordinary disclosure practice, and much of those ten days may have gone on deduplicating machine noise around one or two genuine defects ^[1], in which case what happened here is a triage tax rather than a security event. But the binding constraint for small-maintainer infrastructure now looks like adjudication capacity rather than discovery, since the reports will keep arriving whether or not anybody is funded to read them, and a two-week silence is the rationing device, or rather the only rationing device a project of this size has. The changelog settles it. One or two low-severity entries and the wave was mostly noise; several serious ones and the scanners have earned their keep.