CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24904Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Informational 13 AI analysisMessage 88 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

tests: add coverage for exact-size DER signature serialization

This commit only adds a new test case. It checks that a DER signature can be written into a buffer that is exactly the right size, and that writing into a buffer one byte too small fails correctly. There is no change to the actual library …

500ccb60by Bruno Garcia+12−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

Fix reproducible build (#371) (#412)

This commit fixes the firmware build process so that two people building from the same source code get the exact same binary file. Previously, the build script embedded local git details (like the repository URL, branch name, or commit has…

Reproducible build hardeningRemoval of build-environment-dependent metadata from release artifactsHash-locked dependency installation via pip --require-hashes
e4266c10by Schnuartz AI+218−196 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6736: benches: fix encoding use, add CI check, and standardize on criterion

This change is purely a cleanup of benchmark code. It moves the last remaining old-style benchmark into a shared benchmark package, switches the project to use the standard Criterion benchmarking library, and adds a CI check so benchmarks …

06ea6476by Andrew Poelstra+70−6710 files
No security note in commit
Open full analysis →Source commit ↗
High 77 AI analysisMessage 93 · Strong
SP SpecterSpecter DIY BitcoinHardware wallets

Fix: Reject dead-TRNG output in get_random_bytes (#370) (#372)

This commit fixes a security bug in how Specter DIY generates random numbers for creating cryptocurrency wallet secrets. Previously, if the hardware random-number generator (TRNG) stalled or failed, the device would silently use all-zero o…

Silent use of dead TRNG output for cryptographic seed generationTRNG timeout returns 0 per byte, producing all-zero or majority-zero buffersEntropy pool was fed with dead bytes before any validation
65fcb983by White7hat7+221−73 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for mk release.

This commit only updates the release signature file (signatures.txt) for the COLDCARD firmware. It adds two new file hashes for a v5.6.2-mk release and refreshes the PGP signature covering the file. There are no code changes, no bug fixes,…

e6d01c36by Peter D. Gray+10−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for q1 release.

This commit only updates a release signature file. It refreshes SHA-256 hashes for changelog files and adds hashes for two new firmware release files, then re-signs the file with a PGP signature. There are no code changes, no bug fixes, an…

a310e1ddby Peter D. Gray+16−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 965,337 to 965,338. It is a routine, automatically generated data refresh with no code logic changes and no apparent security relevance.

3caf599eby Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

new policy w blank lines

This commit only edits the project's internal release notes file. It replaces a detailed list of upcoming changes with placeholder 'tbd' entries and adds a note asking contributors to leave blank lines between additions. There are no code …

3d8f90f1by Peter D. Gray+9−561 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update for new release

This commit is a release-notes-only update for the COLDCARD hardware wallet firmware. It moves many security-relevant bug fixes and hardening items from the current changelog into the historical release notes for versions 5.6.1 and 1.5.1Q,…

USB protocol encryption upgrade (ncry v3) with direction-separated keys and replay protectionPSBT tampering detection: re-verify staged bytes before signing after Virtual Disk overwriteFirmware update integrity: abort if staged image overwritten, reject images extending past world-checksum region
ea2b89bfby Peter D. Gray+272−1124 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: remove deadcode from `pyright_tool.py`

This commit is a routine cleanup of an internal Python linting helper script. It removes unused features from `pyright_tool.py` (a tool that manages type-checker suppressions) and updates two comments in unrelated firmware source files to …

ac25643bby obrusvit+8−1683 files
No security note in commit
Open full analysis →Source commit ↗
High 78 AI analysisMessage 85 · Strong
SP SpecterSpecter DIY BitcoinHardware wallets

feat: Fix change-output classification to require verified descriptor derivation (#387)

This commit fixes a security bug in Specter DIY, a hardware wallet, where the device could wrongly hide a transaction output as 'change' (your own money coming back) when it actually went to an attacker or to another of your own wallet add…

Fixes incorrect change-output classification that could hide attacker-controlled or self-payment outputsAdds cryptographic verification of PSBT derivation metadata against locally stored descriptor and output scriptPubKeyAdds explicit warnings for inconsistent host-supplied change metadata
fc0e32d6by Schnuartz AI+1514−599 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 963,314 to 965,337, along with its timestamp. It is an automatic, routine data refresh with no code logic changes and no apparent security relevance.

15deb2f6by Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →