There are ~100 issues reported by Project Loupe that are "real" bugs, but not security issues. These can range from, a few severe issues that a user might actually hit during normal usage (e.g. dergoegge/loupe-bitcoin-core-public#1), to many minor less likely things (e.g. dergoegge/loupe-bitcoin-core-public#2).
There are other similar efforts to Loupe, where I'd assume the outcome looks similar. This is also obvious from a lot of PRs opened within the last 6-12 months.
How do we want to handle these issues going forward?
Some thoughts I had:
- Severe and likely to occur issues should obviously be fixed (these are by far not the majority)
- If we don't fix them, they will be repeatedly reported
- If do want to fix them all, we'll have 100s of additional open Issues/PRs, and I don't think we can manage that at our usual pace
- While an LLM can verify/triage these issue and decrease the likelyhood of false positives, it's likely not perfect, and human triaging is still needed
- We could decide to fix issues only once real users report them (obviously anyone could just say "i encountered this" and have their PR accepted)
- We could collect them in a public repo to be able to reference them (e.g. when closing PRs)
- My guess is that, even if we decide to fix all of them, there would be an infinite stream these going forward anyway