Security

0.x expectations

• On-disk format and public APIs are unstable until 1.0.
• Mainnet. Consensus is independent of bitcoin core’s engine; coverage is growing across functional, fuzz, and specification tests. Divergence is still possible until 1.0 — see what the tests cover.
• 0.x.x is the supported published line until 0.x or 1.0. No multi-year LTS branch yet.
• This is not a turnkey appliance.

What the tests cover

Independent consensus is the live risk. Tests do not change that. The node runs bitcoin core’s transaction fixtures, 71 unmodified bitcoin core v31.1 functional tests (excluding wallet, prune, and plaintext v1 P2P — 62 at 0.5.2, 14 at 0.5.0), Hornet Node’s published block-validation rules mapped onto rbitcoin’s own cases, and nightly differential fuzz against official bitcoind (block, spend, fork, compact, script, BIP324). Line coverage is a required GitHub Actions gate: below 90% LCOV on production files, the PR fails. Last green master coverage job: 91.93% (126876 / 138009 LH/LF, 2026-09-13) — method in TESTING.md. Coverage is still not proof the implementations cannot diverge — report a consensus mismatch privately.

Milestone and script checks

Default mainnet --milestone skips script and signature checks at or below that height. Same idea as assumevalid. Prevouts, double-spends, maturity, and fees still run.

Use --milestone 0 if you want every historical script checked. The default flag is not a claim that they were.

In scope (node)

• Consensus and script: accepting invalid chain data or rejecting valid data
• P2P (BIP324 v2 only): denial-of-service and misbehavior handling
• Electrum and Esplora: integrity and application-level DoS limits
• Optional JSON-RPC: authentication, integrity of documented methods (not a full core surface)
• Store and archive: corruption or incorrect spend or scripthash results that could mislead a wallet backend

Full policy: node SECURITY.md. Report against a git commit (and the binary digest if you built the musl static release).

Out of scope (for security@)

• Feature requests, IBD performance tuning, and non-sensitive crashes—use ordinary issues or CONTRIBUTING
• Compromised operator hosts, reverse-proxy misconfiguration, or third-party wallets outside this tree
• Do not send seed phrases or private keys

This website

rbitcoin.org is static HTML, CSS, and JavaScript. No backend. Report serious site issues — XSS in checked-in scripts, for example — to security@reardencode.com. Typos and broken links can be ordinary issues or pull requests.

Contact

• Security security@reardencode.com
• General freedom@reardencode.com
• X @reardencode
• Source github.com/reardencode/rbitcoin

Use security@ for vulnerability reports. Freedom@ and X are for everything else—not for unfixed consensus or remote-attack bugs.