I am curious about the process Bitcoin developers follow to address and resolve critical software vulnerabilities, such as bugs or flaws, that could be exploited by attackers to disrupt the network or steal funds.
Consider this hypothetical scenario: I discover a significant software vulnerability in Bitcoin's software, for instance, a bug that could be used to destabilise the network. Suppose I can create a transaction that causes a Bitcoin node to crash when it processes the transaction and verifies its compliance with consensus rules. This error would be easily reproducible by relying the transaction to a node running the most recent version (currently Bitcoin Core 24.0.1). Nodes operating on older releases would remain unaffected. In a matter of seconds, such a bug could crash over 30% of the active Bitcoin nodes running version 24.0.1, causing considerable disruption to the network, albeit temporarily.
As an open-source project, Bitcoin's source code is publicly accessible on GitHub. Bugs are typically reported through the issue tracker at https://github.com/bitcoin/bitcoin/issues. However, in this hypothetical situation, I would choose to "responsibly disclose" the bug to one of the prominent Bitcoin Core developers.
My inquiry is twofold: How can a severe security bug be fixed in a new version without the public becoming aware of the fix, preventing anyone from exploiting the bug? Alternatively, what steps would Bitcoin developers take in such a case?