CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24355Commits captured
20925AI analyses
54High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

20925 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11281 from ziggie1984/lint-intrange-cleanup

This commit is a large but purely cosmetic code cleanup. It replaces old-style Go for loops like 'for i := 0; i < N; i++' with the newer 'for i := range N' syntax introduced in Go 1.22. No logic, behavior, or security properties of the cod…

95c56eebby Olaoluwa Osuntokun+144−14449 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 73 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #702 from Foundation-Devices/SFT-7378-passphrase-length-cap

This commit fixes a design flaw in the Passport hardware wallet where users could enter a passphrase longer than the wallet's key-derivation function actually reads. Previously, extra characters were silently ignored, meaning two different…

silent truncation of user-controlled secret inputBIP39 seed derivation mismatch with other walletsUI input limit did not match cryptographic read limit
41711800by mjg-foundation+59−13 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker build:

This commit fixes a broken GitHub Actions workflow file that builds and publishes Docker images. It corrects a variable name (from 'platform' to 'arch') and adds a missing period at the end of the docker build command. There is no security…

10118fbdby Lee *!* Clagett+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

tests: migrate pin action tests from test_jade to rpc tests

This commit simply moves existing test cases from one test file to another. It does not change any production code, security behavior, or fix any vulnerability. The tests check that the Jade device correctly rejects invalid parameters for …

be0e6b3dby Mike Tolkachev+42−402 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker action file

This commit fixes a YAML indentation error in a GitHub Actions workflow file. It changes one line of spacing so the Docker login step is correctly aligned under the job's steps list. There is no security-relevant change to the software its…

bff4b1b4by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 53 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Simplify plugin database contexts (#7611)

This commit is a code cleanup and developer-experience improvement for how BTCPay Server plugins manage their PostgreSQL databases. It introduces a shared helper and base class so plugin authors no longer need to manually wire up database …

Database configuration logic moved into shared extension; reduces copy-paste errors in pluginsCustom CREATE DATABASE generator preserved with hardcoded TEMPLATE template0, LC_CTYPE C, LC_COLLATE C, ENCODING UTF8New design-time default connection string uses fixed host 127.0.0.1:39372 and database btcpay_plugin_design_time
ae3abbb0by Nicolas Dorier+400−1369 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker build command

This commit fixes a typo in a GitHub Actions workflow file. The Docker build command had an extra word ('build build') that would cause the automated Docker image build to fail. It is a routine CI/CD fix with no security relevance.

e5d4b3a7by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker build matrix

This commit fixes a GitHub Actions workflow syntax error. The 'matrix' keyword was missing its required parent 'strategy' wrapper, which would prevent Docker build jobs from running correctly. There is no security relevance in the code cha…

800e026fby Lee *!* Clagett+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36375: wallet: accept uppercase addresses without amount in sendall

This patch fixes a bug in Bitcoin Core's `sendall` wallet command. If a user typed a bech32 address in uppercase letters, the command would fail with a confusing 'below dust threshold' error instead of sending the funds. The fix compares d…

Functional bug in RPC command causing unexpected transaction failureCase-sensitivity mismatch between user input and canonical address encodingNo memory safety, cryptographic, or authorization issue evident
e7aef7e8by Ava Chow+22−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

tests: add tests for pin actions via debug_set_pin

This commit only adds a new test file that exercises PIN-related features of the Jade hardware wallet using a debug-only RPC command. It does not change any production code, introduce new functionality, or alter security behavior. The test…

dd3d5b22by Mike Tolkachev+334−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36381: test: avoid testing at the exact `-maxfeerate` boundary

This commit fixes a flaky automated test in Bitcoin Core. The test was checking the maximum transaction fee rate by creating a transaction at the exact boundary, which sometimes failed because the real transaction size could be slightly sm…

No production code changedTest-only changeNo memory safety, cryptography, consensus, or authorization changes
ba8fdb97by Ava Chow+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

test fixes

This commit only adjusts test scripts and the simulator's fake secure-element storage. It makes tests more reliable by waiting for screens longer, refreshing menus after settings changes, ignoring a harmless internal counter, and keeping s…

33525668by scgbckbone+37−115 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →