Responsible disclosure & release verification for BitcoBoost (BCBO)
If you discover a security vulnerability in BitcoBoost Core, the block explorer, the mining pool or the website, please report it privately to support@bitcoboost.com with the subject line SECURITY. Please do not disclose the issue publicly until it has been investigated and addressed. We aim to acknowledge reports within a few business days.
| In scope | BitcoBoost Core node (bitcoboostd), consensus and P2P; the public explorer; the mining pool; bitcoboost.com and its APIs. |
|---|---|
| Out of scope | Third-party mining software, user key management, and issues requiring physical access to a user's device. |
Security fixes are provided for the latest tagged release of BitcoBoost Core. Node operators and integrators should track GitHub Releases and run a supported version.
Release artifacts are published with SHA-256 checksums (SHA256SUMS). The Windows desktop application is Authenticode-signed by Primaris Group S.r.l.s. (Microsoft ID Verified Code Signing). Always verify checksums and signatures before running downloaded binaries.
The reference node ships hard-coded checkpoints (compiled into the public source, distributed via checksummed releases, optional via -checkpoints=0) that finalise chain history below the most recent checkpoint, mitigating deep chain-reorganisation. Full governance: Checkpoint Security Model. Public RPC command execution is disabled on the public explorer. See the technical paper for security assumptions.
