CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24904Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10903 from SomberNight/202608_fix_type_hints_optional

This commit only updates Python type hints to explicitly mark parameters and variables that can be None. It does not change any program logic, runtime behavior, or security checks. It is a code-quality and documentation improvement with no…

10538dbcby Felix+144−14251 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 65 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

chore: Update embit to v0.8.2 (#376)

This commit updates the embedded embit cryptography library to version 0.8.2 and adds a small compatibility shim so Specter DIY can accept a new style of Bitcoin wallet descriptor that mixes fixed and multi-path keys. Most of the changes a…

Dependency update to embit v0.8.2Monkey-patch of cryptographic descriptor parsing to bypass a library validation errorNew test coverage for mixed multipath/fixed-path descriptor parsing
2ff670caby Mike Tolkachev+224−1116 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 73 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

Re-add mixed-inputs warning for multi-wallet transactions (#382)

This commit restores a security warning on the Specter DIY hardware wallet. When a user is about to sign a Bitcoin transaction that spends coins from more than one wallet, or from several unknown sources, the device now shows a clear 'mixe…

Re-adds a security warning that was previously removedMitigates multisig/mixed-input change-address attack classWarning is now displayed at the top of the confirmation screen without requiring scrolling
72234589by Schnuartz AI+283−218 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6811: ci: add corpus fuzzing crash store

This commit is a CI (Continuous Integration) improvement for the project's fuzz testing pipeline. It adds a persistent 'crash store' so that fuzzing crashes are saved and later replayed to catch regressions. It does not change the actual B…

No library code changesNo cryptographic or parsing logic changesCI-only fuzzing infrastructure change
86e705f0by Andrew Poelstra+176−245 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

factorysetup: speed up certificate setup

This commit is a performance optimization in the BitBox02 factory setup process. It changes how the device picks which trusted root public key to use when verifying an attestation certificate. Previously, the device tried verifying the sig…

No removal of cryptographic verification: rust_secp256k1_verify is still performed after key selection.No change to accepted inputs: any certificate accepted before is still accepted, and any rejected before is still rejected.Identifier comparison uses MEMEQ over the full 32-byte SHA-256 digest, so collision resistance is standard.
d5617112by benma's agent+10−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Merge branch 'nickez/bb03-binaries'

This commit is a large feature merge that adds initial support for a new hardware variant, the BitBox03 (STM32U5-based development kit). It introduces new bootloader and firmware binaries, board support crates, vendored Rust dependencies (…

1a648595by Niklas Dusenlund+17103−5779170 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

schemas: make required fields match the code

This commit is a large cleanup of Core Lightning's API schemas, generated RPC bindings, and related plugin code. The stated goal is to make the documented 'required' fields match what the C code actually always produces or expects. In prac…

Large schema-only change with no accompanying security advisory or CVEOne semantic change to plugin hook response: invoice_payment hook can now reject with only failure_message and no resultMany fields change from optional to required in public RPC/protobuf interfaces
ddbd2963by daywalker90+1786−173950 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): save 15KB of flash by eliminating source filenames

This commit is a routine size-optimization change for the Trezor firmware. It removes source filenames from compiled code to save 15KB of flash storage and rearranges linker sections. There is no indication this is a security fix or introd…

8eb27f83by cepetr+4−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 73 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Merge pull request #546 from LedgerHQ/simplify_ast

This commit is a large internal refactoring of the Ledger Bitcoin app's wallet-policy parser. It replaces compact 'relative pointers' with ordinary memory pointers in the abstract syntax tree (AST) used to represent Bitcoin wallet descript…

Large-scale memory-layout refactoring of security-critical parserRemoval of custom relative-pointer abstraction, eliminating a class of offset-calculation bugsIncrease in policy buffer size limits and key-info length limits
efee9c25by Salvatore Ingala+412−55812 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36118: test: tolerate race condition in interface_http.py

This commit only changes a test script. It makes the test accept either receiving an HTTP error response or the connection being abruptly closed, because on Windows the Python test client sometimes sees the socket close before it can read …

No production code changesTest-only race-condition toleranceServer still logs HTTP 400 and disconnects misbehaving clients
7f0c4020by merge-script+24−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 82 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tests): use named parameters

This commit only rewrites test code to use named pytest parameters (adding readable IDs to test cases). It does not change any production firmware, wallet logic, or security behavior. There is no security issue here.

54a213d7by M1nd3r+7050−690718 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 90 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/bootloader): mark check_vendor_header_lock warn-unused-result

This is a small hardening change to the Trezor bootloader. It adds a compiler warning attribute to a security check function so that future programmers cannot accidentally call it and ignore its pass/fail result. The current code already u…

Authorization check result could be silently dropped without compiler warningFunction added warn-unused-result attribute to match sibling security checksNo call-site changes because existing callers already consume the return value
f58e7e79by tychovrahe+2−22 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →