Q: What is the main approach recommended in the Bitcoin AI security audit guide? A: The Bitcoin AI security audit guide recommends a step-by-step workflow: set scope and goals, choose models and tools, prepare clean context, run a fast first pass, focus on Lightning, perform sandboxed dynamic tests, triage with humans, and disclose and backport fixes. It emphasizes using models like Kimi K3 and GLM together with static scanners and human review to confirm findings and ship patches. Q: Which AI models and non-AI tools does the guide suggest using? A: The guide advises using multiple models, including local/downloadable models such as Kimi K3 and GLM 5.2/5.3 for long-context code review and hosted GPT-4-class or Claude-class models for patch polish when permitted. It also recommends complementing models with static scanners (Semgrep, Bandit, gosec, cargo-audit, npm/pip-audit), secrets scanners (truffleHog, gitleaks), SBOM/deps tools (Syft, Grype, OSV/OSS Index), and fuzzers like AFL and libFuzzer. Q: How should teams prepare code and context before running models? A: Prepare a clean context by generating an SBOM, creating small code maps that show folder trees and entry points, and including key files such as README, configs, threat notes, and change logs. Chunk large codebases for focused prompts and always redact secrets before sharing anything with hosted models. Q: What should a fast first-pass AI scan look for in Bitcoin projects? A: A first pass should scan for secret leaks, weak randomness in key generation or nonces, misuse of crypto libraries (secp256k1 handling, Schnorr use, PSBT parsing), unsafe deserialization, command injection, and path traversal. It should also check network risks, dependency issues, wallet logic errors, and have models output a short title, file/line locations, an exploit rationale, a minimal proof or test idea, and a sketch patch. Q: Why focus on Lightning code and what specific Lightning risks does the guide prioritize? A: The guide singles out Lightning because its code is complex and proved harder than average in recent audits, so teams should prioritize channel backups and restore paths, HTLC timeouts and edge cases, fee caps and dust limits, invoice and route handling, gossip and onion-routing validation, and watchtower and penalty-transaction logic. It also recommends simulating failure states such as stuck HTLCs, chain reorgs on testnet/regtest, disk-full conditions, crash-on-restart, and state replay scenarios. Q: How should teams run dynamic tests and agents safely according to the guide? A: Run dynamic tests in isolated sandboxes by spinning up test containers or VMs, giving the model a safe target, recording every action and input, and resetting the environment after each run. Block outbound network calls unless needed and never run agents against production systems. Q: What is the recommended human triage process after AI flags vulnerabilities? A: Triage findings with humans in the loop by reproducing issues quickly, scoring severity with a shared rubric (e.g., CVSS), eliminating false positives, and merging duplicates across models. Then draft small patches and tests and use a second model to review the fix for regressions or new risks before disclosure. Q: How can teams make AI audits an ongoing part of development rather than a one-time sprint? A: Turn audits into a pipeline by integrating pre-commit secret scans, pull-request scans, nightly model reviews on hot paths, and monthly full scans with updated prompts, plus automated alerts for new CVEs in your SBOM. Track metrics such as time to first response, time to fix, false positive rate and coverage, and keep the Bitcoin AI security audit guide as a playbook to move fast and patch often.