AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

exposesecret: Add support for mnemonic-based HSM secrets

Public commit record

What the developer wrote

Authored by Sangbida Chaudhuri

73/100 · Adequate
exposesecret: Add support for mnemonic-based HSM secrets

Update the exposesecret plugin to work with the new unified HSM secret
format that supports BIP39 mnemonics.

Changelog-Added - exposesecret now has a mnemonic field
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a new feature to the Core Lightning 'exposesecret' plugin. It allows users who have set up their node with a BIP39 mnemonic (a human-readable seed phrase) to retrieve that mnemonic through the plugin's API. The change also includes some internal cleanup for how mnemonic secrets are handled and converted into cryptographic seeds. There is no indication in the commit that this fixes a security vulnerability; it is a feature addition.

Recommended action

No security action required. Reviewers may want to confirm that exposing the mnemonic through the exposesecret API is intentional and consistent with the plugin's existing security model (it already exposes the codex32-encoded secret).

Security signals we found

01

Feature addition, not a security patch

02

Adds exposure of BIP39 mnemonic via exposesecret response

03

Refactors libwally memory context handling in mnemonic validation/derivation

04

No mention of vulnerability, CVE, or security fix in commit message or diff

Risk score

Why this scored 15/100

Our methodology →
Potential impact 0/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 0/15
Confidence 10/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.