English
Project Loupe
Report

Project Loupe✓

@ProjectLoupe

An AI-powered vulnerability scanner for open-source bitcoin projects. Discord: https://t.co/VF8q4cOqdC

0 Following1.3K Followers38 Posts
  2. Project Loupe✓@ProjectLoupe
    Project Loupe
    RT @callebtc: @moneyball @spiral_xyz project loupe is an absolute treasure for the bitcoin ecosystem! thank you for the reviews, incredibly valuable for the Cashu project.
    01020
  3. Project Loupe✓@ProjectLoupe
    Project Loupe
    RT @moneyball: One of the best ideas @spiral_xyz has had
    bitcoin++ @ seoul, nov 5-6 🇰🇷 @btcplusplus
    Project Loupe - AI powered security scanning for Bitcoin OSS Projects
    08021
  5. Project Loupe✓@ProjectLoupe
    We file our findings privately. Loupe only shows up in public if a maintainer credits us, which many have: ✅ 754 commits, PRs, & release notes across 23 projects reference Loupe ✅ 610 distinct findings cited by issue number ✅ 132 merged PRs name the finding they fixed
    05213.2K
  6. Project Loupe✓@ProjectLoupe
    Loupe findings have been landing in Bitcoin Core. During this cycle, five PRs landed: three have been merged, two are under review. Below is a thread on what each one caught and which Core dev implemented which fix.
    220525.5K
  7. Project Loupe✓@ProjectLoupe
    Posts @ProjectLoupe
    📦 In review: a package evicted right after acceptance landed in the reject filter until the next block, so a higher-fee child couldn't bump it back in. Loupe and the Bitcoin Red Team found it, @theinstagibbs fixed it.
    125229
  8. Project Loupe✓@ProjectLoupe
    Posts @ProjectLoupe
    🕳️ Also from a Loupe report: @theinstagibbs mapped out how a peer sending a same-txid witness variant can stall honest fee-bumping packages, and is closing those holes across two PRs. That work continues.
    027227
  10. Project Loupe✓@ProjectLoupe
    A second opinion: ✅ Another model double-checks every finding ✅ It returns "inconclusive" 30.2% of the time ✅ 88% of "dismissed" findings weren’t refuted but rather not established ✅ 3,671 findings were verified more than once and only 105 got a conflicting verdict
    Project Loupe @ProjectLoupe
    Some personal news: ✅ Loupe has produced 26,821 findings across 43 open-source bitcoin repos ✅ Average successful scan took 2H 52M and returned 53.6 findings ✅ Longest scan ran for 36H 58M ✅ 26,809/26,821 findings shipped a proof-of-concept & 12,774 shipped a proposed patch
    2272.3K
  11. Project Loupe✓@ProjectLoupe
    Some personal news: ✅ Loupe has produced 26,821 findings across 43 open-source bitcoin repos ✅ Average successful scan took 2H 52M and returned 53.6 findings ✅ Longest scan ran for 36H 58M ✅ 26,809/26,821 findings shipped a proof-of-concept & 12,774 shipped a proposed patch
    429213419K
  12. Project Loupe✓@ProjectLoupe
    Project Loupe
    RT @lightningdevkit: LDK 0.1.13, 0.2.7, and 0.3-rc3 are now available, with fixes for several security vulnerabilities, including fund theft. If you run LDK in production with untrusted channel counterparties, we recommend upgrading today. If you’re testing 0.3, update to rc3. 1/4
    024028
  15. Project Loupe✓@ProjectLoupe
    Project Loupe
    RT @BTCSchellingpt: upgrade your project's security posture the cyber security landscape has fundamentally and permanently changed .. so where to start as a humble FOSS project maintainer and builder? take a squiz at @spiral_xyz's Project Loupe: What is it? Does it work? Where is it?
    02030
  16. Project Loupe✓@ProjectLoupe
    Project Loupe
    RT @PresidioBitcoin: Excited to continue pushing out talks and discussions from our Open Source AI Summit! Next up: Securing Open Source Software - @moneyball with @Rob1Ham, @_tnull, and @jordanmecom on how AI is reshaping open source software security: Timestamps 0:00 - How AI is changing open-source software security 03:34 - How AI security scanning works 06:30 - Why open-weight models changed cybersecurity 09:30 - How many vulnerabilities AI scans find 11:58 - Why different scanning methods find different vulnerabilities 15:38 - How maintainers should handle AI vulnerability reports 23:29 - How AI changes responsible disclosure 30:15 - Can AI find vulnerabilities without source code?
    014022
  17. Project Loupe✓@ProjectLoupe
    Project Loupe
    RT @spiral_xyz: .@ProjectLoupe reads bitcoin code all day looking for vulns. Fueled by energy drinks and cold pizza, its existence is bleak but necessary. The @StratumV2 team took its findings, fixed them, and rebuilt their security process. Their stack is now among the hardest in mining.
    Project Loupe @ProjectLoupe
    Rare to report bugs and get a rebuilt security process back. Giant ups to the @StratumV2 team on the release, and thanks for being early with us.
    010023
  18. Project Loupe✓@ProjectLoupe
    Rare to report bugs and get a rebuilt security process back. Giant ups to the @StratumV2 team on the release, and thanks for being early with us.
    Stratum V2 @StratumV2
    New SV2 releases are out, bringing security hardening and various other improvements to our libraries and applications! 🧩 SV2 Protocol libs v1.12 🏗️ SV2 Apps v0.8 ⛏️ SV2 UI v0.7 (coming soon on @umbrel) Applications updates improve Job Declaration stability and Bitcoin Core integration, Translator Proxy overhaul, and add automatic discovery of ASIC telemetry endpoints. Protocol library highlights include a deep hardening pass over channels_sv2, a breaking refactor of the codec and framing layer, BIP323 adaptations across the protocol stack. Noise_sv2 was improved with regards to memory hygiene, nonce reuse, RNG quality, and buffer recovery. Every published crate that changed takes an incompatible version bump, so downstream consumers should expect to adapt. We’re proud to have been early participants in @ProjectLoupe . Their findings helped shape this release and gave us a head start in adapting how we triage reports, prioritize fixes, and organize development around security. Thank you to the Loupe team for their work and support!
    04136.1K
  19. Stratum V2✓@StratumV2
    New SV2 releases are out, bringing security hardening and various other improvements to our libraries and applications! 🧩 SV2 Protocol libs v1.12 🏗️ SV2 Apps v0.8 ⛏️ SV2 UI v0.7 (coming soon on @umbrel) Applications updates improve Job Declaration stability and Bitcoin Core integration, Translator Proxy overhaul, and add automatic discovery of ASIC telemetry endpoints. Protocol library highlights include a deep hardening pass over channels_sv2, a breaking refactor of the codec and framing layer, BIP323 adaptations across the protocol stack. Noise_sv2 was improved with regards to memory hygiene, nonce reuse, RNG quality, and buffer recovery. Every published crate that changed takes an incompatible version bump, so downstream consumers should expect to adapt. We’re proud to have been early participants in @ProjectLoupe . Their findings helped shape this release and gave us a head start in adapting how we triage reports, prioritize fixes, and organize development around security. Thank you to the Loupe team for their work and support!
    6124614.9K
  20. Show more posts