CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24903Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Low 46 AI analysisMessage 36 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

fix lnurl (#7563)

This commit fixes a bug in BTCPay Server's LNURL feature for pull payments. Previously, if someone requested a LNURL for a pull payment that didn't exist, the code would try to use a null (empty) pull payment object, which could cause the …

Null dereference / missing null check on database/service lookup resultPotential server-side exception (DoS/crash) on crafted LNURL requestInformation disclosure risk if exception details leak stack traces
227912f2by monasco+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 63 · Adequate
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Update POS callback authentication guidance (#7566)

This commit only updates user-facing help text in the Point of Sale plugin. It replaces outdated guidance about legacy API keys and Basic authentication with newer guidance about API tokens and the correct REST API endpoint. No code logic,…

045f70a2by Nicolas Dorier+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet_rpc_server: reject --password with --wallet-dir

This change stops users from starting the Monero wallet RPC server with both a global wallet password and a wallet directory mode. When running with --wallet-dir, the server can manage multiple wallets, each with its own password. Supplyin…

CLI argument combination now rejected that could have led to a single password being used across multiple wallets in --wallet-dir modeCompletion scripts updated to prevent users from accidentally selecting the incompatible combinationNo cryptographic or network-layer changes; the fix is at the configuration/startup boundary
4cf7d6a2by Thomas+15−34 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix test

This is a one-line change to a test file. It adjusts an assertion so that the test now expects a database-migrated API key to have a null CreatedAt value instead of a non-null value. There is no production code change and no security relev…

ecfb7990by Nicolas Dorier+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 69 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36169: http: Use SO_EXCLUSIVEADDRUSE on Windows

This update fixes a Windows-only security hole in Bitcoin Core's built-in web server. Previously, the software allowed another program running on the same computer to grab the same network port and potentially steal the secret RPC password…

Credential interception via shared local port bindingLocal privilege boundary crossingWindows-specific socket option misuse
5f0daa0eby merge-script+25−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

PSBTv2 per input required lock time calculation

This commit adds support in the COLDCARD firmware for a newer Bitcoin transaction format feature (PSBTv2) that lets each input specify its own required lock time. Before this change, the device did not correctly compute the final transacti…

PSBTv2 per-input locktime parsing and validation addedBIP-370 required locktime computation implementedIncompatible height/time locktime requirements rejected with assertion
2ea2e791by scgbckbone+191−336 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 45 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet_rpc_server: validate seed language early

This change moves an error check earlier in the Monero wallet's 'generate wallet from keys' RPC command. Previously, the code would create a wallet file before checking whether the requested seed language was valid. Now it checks the langu…

Input validation moved earlier in request handlingNew functional test asserts no wallet files are created on invalid languageLanguage parameter added to RPC test helper
c065397bby Samy+41−73 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Merge remote-tracking branch 'agent/benma-agent/scroll-payment-request-memo-name'

This commit tweaks how the BitBox02 hardware wallet displays a payment-request memo on screen. It changes the label from 'Memo from\n\nMerchant' to 'Memo from: Merchant' and makes the screen scrollable so long merchant names don't get cut …

No security-relevant signal in commit message or diffUI/UX change only: text formatting and scrollabilityNo memory-safety, cryptographic, or authorization changes observed
be375664by Marko Bencun+115−66 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6819: Remove panics from `LegacyPublicKey::from_str`

This change refactors how a Bitcoin public key is parsed from a text string so that the code no longer relies on 'this should never happen' assumptions that could trigger a program crash. The old code only accepted two exact string lengths…

Removal of unreachable! panic branches in parsing codeDefensive refactor to make panic-freedom locally obviousImproved error handling for malformed input lengths
03eb46e4by Andrew Poelstra+10−191 file
No security note in commit
Open full analysis →Source commit ↗
High 70 AI analysisMessage 86 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36123: http: throttle per-connection reads while a request is in flight

This update fixes a memory exhaustion bug in Bitcoin Core's built-in web server. An authenticated user could keep one slow request open and then flood the server with endless extra data, causing it to run out of memory. The fix tells the s…

Memory exhaustion / OOM vector in HTTP serverUnbounded receive buffer growth on authenticated connectionPer-connection read throttling via event-loop change
f0c839acby merge-script+103−43 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Wallet API: setStatusCritical for recoverFromDevice

This commit changes one line in Monero's wallet API. When recovering a wallet from a hardware device fails, the code now marks the error as 'critical' rather than just a regular error. This is a status/severity classification change, not a…

Status-severity change onlyNo change to error string or control flowNo cryptographic or memory-safety modifications
d3f4b3e4by SNeedlewoods+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 45 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Merge branch 'refact-api-keys'

This commit refactors how BTCPay Server stores and handles API keys. Previously, the secret API key itself was used as the database primary key, meaning the full secret was stored in plaintext and appeared in URLs/revocation endpoints. Now…

API key secrets no longer used as database primary key or in revocation URLsDatabase now stores SHA256 hash of secret rather than plaintext secret for authentication lookupNew ephemeral Key column cleared after 5 minutes by scheduled cleanup
7ec0260bby Nicolas Dorier+368−39129 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →