CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24904Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6715: internals: migrate the `u256` type from the include system to the internals package

This commit is a routine internal code reorganization. It moves a 256-bit unsigned integer helper type (U256) from a duplicated file that was copy-pasted into multiple crates into a single shared internal crate. It also cleans up some test…

9fb8d3faby Andrew Poelstra+1560−153718 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 68 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

v6.4.4 Release Candidate (#3594)

This is a routine version-bump release candidate for Cake Wallet/Monero.com (6.4.4). The visible code changes are mostly version numbers, localized changelogs, dependency updates, and two small functional tweaks: disabling the 'Swaps.XYZ' …

Dependency version bumps (trezor-flutter, breez_sdk_spark_flutter) without visible vulnerability detailsExchange provider disabled by default (Swaps.XYZ) in migration 71Re-entrancy guard added to NFT send authentication flow
93201806by Omar Hatem+104−7441 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 78 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

factorysetup: use static secp context

This commit changes how the BitBox02 factory-setup program checks digital signatures. It switches from a dynamically created crypto context to a built-in, read-only verification context, which makes the factory-setup firmware about 35 KB s…

Cryptographic context change in verification pathRemoval of dynamic secp256k1 context creation in factory setupExplicit addition of secp256k1_selftest() to compensate for skipped implicit self-test
2756aca4by benma's agent+26−42 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 53 AI analysisMessage 81 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

merge branch "lightning: fix anchor channel backup"

This commit fixes a bug in Electrum's Lightning channel backups for 'anchor' channels. Previously, the backup did not store enough secret key information, so users with non-deterministic Lightning wallets who restored from a backup could n…

Fixes incomplete backup data that could prevent fund recovery after remote force-closeAdds user-facing warnings for outdated/unusable channel backupsChanges backup serialization format and version
b8ae9a55by SomberNight+768−17019 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(trezorlib): improve terse firmware header output

This commit is a minor user-interface improvement for a developer/debugging tool. It adds a 'verbose' mode to the text output shown when inspecting a Trezor firmware file header. In non-verbose mode it now prints a shorter summary (device …

ace402bdby cepetr+18−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

fix test import

This is a one-line fix in a test file that updates an import path from an old package name ('paymint') to the current package name ('stackwallet'). It does not change any production code, user-facing behavior, or security logic. It simply …

97cfbd96by Julian+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Firo: recognize Spark V2 spend transactions

This commit updates the Stack Wallet app so it can correctly identify a newer kind of Firo cryptocurrency transaction (Spark V2 spends). Previously, the wallet only recognized one transaction type as a Spark spend; now it also recognizes t…

Transaction classification logic changed to recognize additional spend typeNo input validation, cryptography, or authorization changes observedNo vendor disclosure of security relevance in commit or references
67dd11b5by Navid Rahimi+17−13 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

disable zeroconf as client if forwarding is enabled.

This commit changes how Electrum's Lightning wallet advertises and accepts 'zeroconf' channels when payment forwarding is enabled. Zeroconf channels are opened instantly without waiting for on-chain confirmations, which is useful for recei…

Prevents forwarding nodes from accepting zeroconf channels, reducing exposure to unconfirmed-channel attacksRejects JIT zeroconf channel opens during trampoline forwardingTightens feature-bit advertisement so clients only signal zeroconf support to their trusted provider unless forwarding
84ddffc4by ThomasV+18−133 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(l10n): Indonesian fixes for Bolt/Caesar/Delizia

This commit updates Indonesian language translations for the Trezor hardware wallet. It adjusts wording and line breaks for different device models (Bolt, Caesar, Delizia, Eckhart) and updates the translation signature file. There are no c…

f408bcebby Michal Kazda+15−102 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11125 from bhandras/codex/reorg-aware-output-lock-20260825

This commit adds a new optional wallet feature to LND that lets users lock UTXOs until the transaction spending them reaches a chosen confirmation depth, instead of relying on a wall-clock timeout. It is a feature addition with safety chec…

New RPC fields release_after_spend_confs and confirmed_spend_height added to LeaseOutput and FundPsbtCustom lock ID enforced as required for confirmation-controlled FundPsbt leases; all-zero and reserved internal IDs rejectedCapability check (ResolveOutputLeaser) prevents silent downgrade to time-only lease when confirmation control is requested
80dde144by Yong+1293−10021 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Harden API key storage

This commit changes how BTCPay Server stores and handles API keys. Previously, the secret API key itself was used as the database primary key and was stored in plaintext. After this change, the database stores a one-way hash of the secret,…

Database now stores SHA-256 hash of API key secret instead of the secret itselfAPI key secret is cleared from database after creation via scheduled cleanup jobPublic management ID (akid_*) is separated from the secret
b1294924by Nicolas Dorier+368−39129 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core/xtask): let flash take an explicit binary

This commit adds a `-f/--file` option to Trezor's internal `flash` developer tool so engineers can flash a prebuilt firmware or bootloader file instead of only the binary produced by the current source tree. The same commit also fixes a co…

Fixes potential command-injection / argument-injection in OpenOCD `-c` script construction by quoting the binary path for Tcl parsingNew `tcl_quote_path` helper validates and rejects paths that cannot be safely brace-quotedAdds unit tests demonstrating the quoting behavior and rejection of dangerous path characters
ae4272d1by tychovrahe+122−102 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →