Bitcoin Core 32.1, Lightning security fixes, and a question for node operators

I've been following the recent Bitcoin Core and Lightning security updates, and one thing keeps bothering me.

We often treat a successful software update as the end of the security process.

But what about everything surrounding the node?

A fully updated Bitcoin Core installation can still be connected to an exposed RPC interface, a wallet using the wrong backend, or a Lightning service with overly permissive credentials.

The recent developments make this particularly relevant:

• Bitcoin Core 32.1 and the changes to vulnerability disclosure.
• Fresh Core Lightning security fixes.
• AI-assisted vulnerability discovery and what it could mean for disclosure timelines.
• The operational risks that remain after the software is patched.

I wrote an investigation into these developments and put together a practical operator playbook covering version checks, network exposure, Lightning permissions, Tor, release verification and post-update checks.

The investigation is publicly readable; the detailed audit playbook is for paid subscribers.

https://davidebtc186.substack.com/p/ai-is-finding-bitcoin-bugs-is-your

I'm curious how other node operators approach this.

Beyond installing updates, what security checks do you actually perform on your Bitcoin and Lightning infrastructure?