CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24970Commits captured
21232AI analyses
48High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21232 analyses
Highest risk·RSS
High 73 AI analysisMessage 78 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Validate wrapped-segwit redeem script contents

This update tightens a recently added safety check in the COLDCARD firmware. For a specific type of Bitcoin address (P2SH-P2WSH), the device now verifies that the redeem script provided in the transaction data exactly matches the expected …

Fixes incomplete validation of P2SH-P2WSH redeem scripts in PSBT signingPrevents unknown-fee transaction approval when redeem script is present but incorrectAdds regression test for junk redeem script reaching approval UX without the fix
b03fccb9by scgbckbone+31−53 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 72 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

clnrest: bound XML nesting depth before parsing

This update fixes a crash bug in Core Lightning's REST plugin (clnrest). An attacker could send a specially crafted XML request with hundreds of nested tags. The XML parser used by the plugin processes tags by recursive function calls, so …

Stack overflow via recursive XML parsing (denial of service)Pre-parse iterative depth bound to prevent parser recursionNew BadRequest error response for rejected XML
304a3034by daywalker90+131−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

testing: stabilize simulator multiprocess runs

This commit only changes test scripts and test infrastructure for the COLDCARD firmware simulator. It adjusts timeouts, adds helper functions for waiting on screen text, fixes test flakiness, and tweaks how tests are split across parallel …

9091ce62by scgbckbone+84−3310 files
No security note in commit
Open full analysis →Source commit ↗
High 76 AI analysisMessage 83 · Strong
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Harden BIP322 POR foreign-input check

This commit fixes a bug in COLDCARD's BIP-322 Proof of Reserves (POR) feature. POR lets a wallet prove it controls certain bitcoins without moving them. The bug allowed an attacker to include someone else's unspent coin in the proof by dis…

Bypass of foreign-input rejection in BIP-322 Proof of ReservesAttacker-controlled PSBT keypath metadata used to spoof wallet ownershipPartial signature used to make foreign input appear already signed
8dba7380by scgbckbone+27−33 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Merge pull request #558 from LedgerHQ/embit_private

This commit simply renames an internal Python package from `embit` to `_embit` (a common convention indicating it is private/implementation detail) and updates all import statements accordingly. There is no functional code change and no se…

d438dd03by Salvatore Ingala+7−731 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

fix: lint issues

This commit is a routine code cleanup titled "fix: lint issues". It only refactors how theme colors are accessed in several user-interface screens and widgets, switching from a local variable to inline lookups. There is no change to app be…

bb79edf3by Blazebrain+321−3438 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 92 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

docs(storage): document the public storage API

This commit only adds documentation comments to a C header file. No program code was changed, so it cannot introduce or fix a security bug by itself. The comments describe how the storage API is already supposed to behave, including rules …

ee7c5efbby tychovrahe+198−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

feat: remind users with a balance to back up their recovery phrase

This commit adds a friendly in-app reminder for users who have cryptocurrency in their wallet but have not yet backed up their recovery phrase. It shows a card on the home screen and offers a guided flow to view or dismiss the reminder. Th…

323a1df6by Blazebrain+249−128 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): unify MAX_LENGTH for SimpleChoice

This commit tightens a safety check in the Trezor hardware wallet's user-interface code. It makes sure that a small on-screen menu component can hold at least as many items as the firmware might ever ask it to display, preventing a capacit…

Capacity mismatch between menu-item source limit and UI component storage could cause a runtime panic (denial-of-service on device)Compile-time assertion added to enforce invariant between MAX_MENU_ITEMS and SimpleChoice capacityMagic number 5 replaced by exported named constant to reduce future drift
ecdd6c2aby Vojtěch Nevřela+15−65 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36131: rpc: Improve two field's OpenRPC types

This commit is a documentation-only correction to the machine-readable OpenRPC schema. It changes two type annotations: one says private keys are plain strings (not hex strings), and another says an ancestor-fees field is a number (not an …

259553c6by merge-script+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): separate norcow config from flash layout

This commit is a straightforward internal code cleanup. It moves two configuration constants between header files to remove a circular include dependency between the flash and storage modules. There is no user-facing change, no bug fix, an…

bbbfa2afby tychovrahe+14−53 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: require genuine commitments in VerifyBlindValueProof

This commit fixes a bug in the way confidential transaction value proofs are validated. Previously, the code accepted an explicit 9-byte value or an empty field where a 33-byte cryptographic commitment was expected. It then passed that sho…

Out-of-bounds read in cryptographic proof verificationInsufficient input validation before passing buffer to libsecp256k1Confidential value/asset commitment type confusion
6f1a5131by Byron Hambly+5−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →