CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24903Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6836: bitcoin: move tests reading `tests/data` out of `src`

This commit is a housekeeping change that moves test files from inside the library source code to a separate tests folder. It does not change any production code or fix a security bug. The change makes sure that tests which need data files…

6de8a555by Andrew Poelstra+627−56012 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): disable BIP39 cache

This commit turns off an internal performance cache for BIP39, the system that converts a recovery seed phrase into cryptographic keys on Trezor hardware wallets. Disabling a cache is usually a defensive change: it can prevent sensitive se…

Disables a cryptographic cache that may retain sensitive key-derived materialNo changelog entry or security explanation providedSingle-line build configuration change with no accompanying code patch
59199f20by M1nd3r+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 54 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fail commitment sig verification without counterparty params

This change adds a safety check in a Bitcoin Lightning Network library (LDK). Previously, if the software tried to verify a peer's commitment signature before it had learned the peer's channel parameters, it could crash with a panic. Now i…

Defensive check added on peer-driven code path to prevent panicMissing counterparty_parameters could previously cause panic during commitment transaction constructionChannel closure returned instead of panic
de7ecc2fby auto-pr-bot+24−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Clarify the commitment validation failure message

This commit only changes the wording of an error message sent to peers when a commitment transaction fails validation. It replaces the vague phrase 'Failed to validate our commitment' with the clearer 'Received commitment failed validation…

3284a006by auto-pr-bot+11−114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/bootloader): report the actual error from a failed wipe step

This is a minor bug fix in the Trezor bootloader. When wiping the device, if a step failed, the bootloader always reported the same generic error message ('Could not read BLE status') even when the actual failure was something else, such a…

Incorrect error reporting in bootloader wipe workflowNo change to failure conditions or access controlNo memory safety, cryptographic, or privilege-escalation issue evident
0a0d00aaby tychovrahe+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Move holder commit sig checks to `InMemorySigner`' (#4885)

This commit moves the checks that validate a counterparty's signatures on the holder's commitment and HTLC transactions out of the general channel code and into the signer module (InMemorySigner). Previously, these signature checks were do…

Moved signature validation from channel state machine into signer moduleAdded new tests that corrupt signatures and verify rejectionChanged error message from 'Invalid commitment tx signature from peer' / 'Invalid funding_created signature from peer' to 'Failed to validate our commitment'
83f5ba55by Matt Corallo+626−31024 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 98 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36136: rpc: remove stale "canonical form" claim from getdescriptorinfo help

This is a one-word documentation fix in the help text of a Bitcoin Core RPC command. It removes the claim that getdescriptorinfo returns a descriptor in 'canonical form', because the command actually preserves caller-specific formatting su…

19b0ff2fby merge-script+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/rust): tweak MenuIntent's micropython dependency

This is a small internal code cleanup in the Trezor firmware's Rust UI layer. It moves some MicroPython-specific code into its own submodule and removes an unused import. There is no visible change to user-facing behavior or security-sensi…

No security-relevant behavioral changeRefactor only: code moved into feature-gated submoduleError type switched to module-appropriate MicroPython error type
617e0383by matejcik+32−363 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Add PushNuget.sh

This commit adds a simple build-and-publish helper script for the project's NuGet package. It packages the BTCPayServer.Client library, pushes it to the public NuGet registry using an API key from an environment variable, and creates a mat…

24f5054eby Nicolas Dorier+16−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36127: wallet: remove unused code

This commit is a routine cleanup that removes six pieces of unused wallet code from Bitcoin Core. Nothing is added or changed in behavior; only dead code is deleted. There is no security issue here.

0c6f2af9by merge-script+3−339 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear signing): show signing context on all flows

This commit changes how Trezor hardware wallets display Ethereum transaction details on screen during 'clear signing' flows. It adds more context—such as the contract address, account name, and derivation path—to the confirmation screens a…

UI-only change with no modification to transaction validation or signing logicAdds previously hidden context (contract address, account, derivation path) to user confirmation screensMay reduce phishing risk by making the contract address and signing account more visible, but this is a defensive UX improvement rather than a vulnerability fix
da463970by PrisionMike+12914−127277 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 68 AI analysisMessage 60 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

verify silent payment output scripts before device signing, combining and export

This commit adds safety checks in the Sparrow Bitcoin wallet to verify Silent Payment output scripts before exporting, copying, combining, or sending a transaction to a hardware device for signing. Silent Payments are a privacy feature tha…

Adds explicit validation of silent payment output scripts before signing/exportCatches and surfaces InvalidSilentPaymentException to the user as an error dialogVerifies combined PSBTs after merge and after device signing, not just the original PSBT
ed78418aby Craig Raw+70−33 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →