CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24908Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Informational 18 AI analysisMessage 73 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #648 from Foundation-Devices/dependabot-host-tooling-hygiene

This commit updates the Python Pillow image-processing library used in host-side developer tooling from version 8.x to 12.3.x and requires Python 3.10 or newer. Pillow 8.x is known to have many publicly disclosed security vulnerabilities, …

Dependency version bump of a library with known historical vulnerabilities (Pillow 8.x)Constraint now requires Python 3.10+ alongside the newer Pillow major versionChange is limited to host tooling files (pyproject.toml, setup.py, requirements-optional.txt, tox.ini, DEVELOPMENT.md)
d6c05830by Jacksper13+6−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #649 from Foundation-Devices/bitcoin-safe-wallet-flow

This commit adds support for a new Bitcoin software wallet called 'Bitcoin Safe' to the Passport hardware wallet firmware. It is a straightforward feature addition that registers the wallet in the firmware's list of supported software wall…

9f1e36b0by Jacksper13+27−03 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #653 from Foundation-Devices/show-op-return-output-amount

This update changes how the Passport hardware wallet displays Bitcoin transaction outputs that carry data (OP_RETURN outputs). Previously, only the embedded message was shown. Now the device also shows the amount of bitcoin assigned to tha…

UI spoofing hardening: user-controlled OP_RETURN data is now escaped before renderingNew display of OP_RETURN output amount reduces risk of hidden value leakageUnit test includes an attacker-controlled message simulating fake Amount/Destination headings
433c4a20by Jacksper13+79−33 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 78 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #660 from Foundation-Devices/fix/legacy-settings-overflow

This commit fixes a bug in how the Passport hardware wallet saves its settings to internal flash memory. Previously, the code checked whether the settings data was too large only after it had already picked and erased a flash storage slot.…

Buffer size validation moved before flash write/erase operationsReplaced broken 'assert false' crash path with explicit ValueErrorAdded unit test for oversized settings rejection
180e183dby Jacksper13+34−113 files
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fix FLASH region overflow on T2T1

This commit changes how a memory buffer section named .buf is handled during the build process for the Trezor Model T (T2T1) hardware wallet. By marking it as NOLOAD, the linker no longer includes this uninitialized buffer in the firmware …

Linker script change affecting firmware image size and memory layoutFLASH region overflow prevented by excluding uninitialized RAM buffer from firmware imageIssue #7792 referenced but no security advisory language in commit
7bea7466by M1nd3r+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

wallet: don't delete payment infos when deleting paid/inflight invoice/req

This commit fixes a bug in the Electrum Bitcoin wallet where deleting a paid or in-flight Lightning invoice/request could incorrectly erase important payment records. The change now preserves those records when a payment has already comple…

Data-loss / history-integrity bug: paid payment metadata could be removedPrivacy leak: in-flight Lightning payment info deleted prematurely may leave a payment that cannot be cleaned up laterState-consistency fix: payment status now gates deletion of PaymentInfo
0b94dc39by f321x+7−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: reject non-ASCII BIP-39 passphrases

This update fixes a bug where COLDCARD wallets would accept BIP-39 passphrases containing non-ASCII characters (like accented letters or emojis) or non-printable characters. Because different wallet software normalizes such characters diff…

Behavioral fix that prevents silent derivation of incompatible wallet seedsInput validation added for BIP-39 passphrase across USB, UI, saved-passphrase restore, and note/password lanesRejection of non-printable ASCII and non-ASCII Unicode characters
c1a67660by scgbckbone+155−147 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: verify invoice_request and invoice signatures on read

This change makes LND's BOLT 12 invoice and invoice-request reader actually check that the digital signature is valid, instead of only checking that a signature field exists. Before, an attacker could craft or modify a BOLT 12 message and …

Missing cryptographic verification on parsed BOLT 12 messages replaced with BIP-340 Schnorr signature verificationReader accepted any 64-byte placeholder signature before the patchNew negative tests verify rejection of wrong-signer and tampered Merkle-root fields
aa8bd19fby bitromortac+272−723 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 74 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: capture single-sig segwit change

This commit fixes two related security bugs in the COLDCARD hardware wallet's protection against a known 'BIP-143 amount swap' attack. First, the wallet was recording the claimed amount of a segwit input to its secure cache as soon as a tr…

Fixes deferred persistence of UTXO amount cache until after successful signingFixes missing capture of single-sig segwit change outputs (p2wpkh and p2sh-p2wpkh)Prevents cache poisoning by cancelled/malicious PSBT previews
8979a8a5by scgbckbone+322−806 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 73 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

auto-select custom node on wallet creation (#3592)

This commit fixes a wallet setup flow where a user-added custom server node was saved but not actually selected for use. It also adds a safeguard so node-change notifications only reconnect the active wallet when the node's cryptocurrency …

UI flow fix ensuring user-configured custom node is actually activatedType guard added before node reconnection to prevent mismatched wallet/node connectionsAsynchronous save operations now awaited before subsequent logic runs
68eb1c3dby malik1004x+10−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10910 from f321x/report_exception

This change tightens up Electrum's crash reporter so it cannot be flooded with an unbounded number of exceptions. Before the patch, every unhandled exception was placed in an internal queue with no size limit, which could slowly consume me…

Unbounded queue replaced with bounded queueExceptions now logged immediately instead of silently queuedMemory-growth hardening for crash-reporting path
40ae58faby ThomasV+9−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 81 · Strong
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

Monero: keep the sync progress redrawing during wallet2's warm-up (#3575)

This commit fixes a UI progress-bar issue in the Monero wallet. During the initial warm-up of the underlying wallet engine, the sync progress could stop redrawing and appear frozen. The change also prevents the app from accidentally starti…

Concurrency hardening: deduplicates in-flight node-height requests to avoid resource exhaustion or race conditionsError handling added around FFI pointer access and Isolate.runNo security-relevant signals such as buffer overflows, injection, or key handling
5a497bf0by cyan+50−141 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →