CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24267Commits captured
20890AI analyses
58High-risk findings · 30d
Active security advisories
High

Core Lightning: disable experimental features immediately

Core Lightning is investigating a potential issue affecting experimental features that may impact user funds. The vendor urges every Core Lightning operator running experimental features to disable them immediately.

Affected: Core Lightning nodes with one or more experimental features enabled. The vendor has not yet identified the affected feature, versions, trigger, or whether exploitation or fund loss has occurred.

Action: Follow the vendor instruction and disable all experimental features immediately. Check lightningd configuration and startup arguments for experimental options, restart with them disabled, and do not re-enable them until Core Lightning publishes further guidance.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

20890 analyses
Highest risk·RSS
Informational 19 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1463 from cypherstack/fix/firo-uri-message-to-spark-memo

This commit fixes a small user-experience gap in the Stack Wallet app for Firo cryptocurrency users. When someone scans or opens a Firo payment link (URI) that includes a message and the payment is going to a Spark privacy address, the app…

No security-relevant signals detected in the diff.Change is a UI autofill feature for Firo Spark memos from payment URI messages.No input sanitization changes beyond existing address validation.
48d10009by Julian+20−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35873: test: add a tx_valid vector for CVE-2024-38365

This commit only adds a new test case to Bitcoin Core's transaction validation test data. The test confirms that Bitcoin Core correctly handles a specific signature-checking quirk that caused a bug in another Bitcoin implementation (btcd).…

References CVE-2024-38365 in commit title and test commentsAdds a positive tx_valid test vector for FindAndDelete behaviorNo changes to consensus, script, or P2P code
09e22fbbby merge-script+7−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35835: test: add CONST_SCRIPTCODE failure-path vectors to script_tests.json

This commit only adds new test cases to a Bitcoin Core test data file. It does not change any production code, consensus rules, or network behavior. The tests verify that two specific script error conditions are correctly detected when a p…

Test-only changeAdds regression/edge-case coverage for existing script validation flagsNo production code modified
b47ec7c6by merge-script+11−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36329: psbt: add new test vectors

This commit only adds new test cases for PSBT (Partially Signed Bitcoin Transaction) handling. It does not change any production code, so it cannot introduce a security vulnerability or fix one directly. The new tests check that malformed …

No production code changesTest-only addition of PSBT validation vectorsNo bug fix, vulnerability fix, or behavior change in consensus/network/wallet code
889e7c5aby merge-script+14−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

ci: hw: run the permission debugging script even if uhubctl fails

This change only affects Trezor's internal continuous-integration (CI) hardware-testing workflow. It tells the CI runner to keep going even if the 'uhubctl' USB power-control tool fails, so a follow-up permission-debugging script still run…

78184de0by Martin Milata+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36262: test: cover orphan reconsideration interruptibility

This commit only adds a new automated test to Bitcoin Core. It does not change any production code. The test verifies that a previously fixed denial-of-service bug (CVE-2024-52914) stays fixed by checking that orphan transactions are recon…

Adds regression test for previously disclosed CVE-2024-52914No changes to src/net_processing.cpp or other production codeTest targets interruptibility of orphan transaction reconsideration
0036d5f1by merge-script+69−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#34907: wallet, test: make wallet_fast_rescan robust

This is a test-only change to a Bitcoin Core functional test file. It makes the wallet_fast_rescan test more robust by ensuring the test actually triggers wallet keypool top-ups and verifies block filter rescans find the expected transacti…

36e9e52fby merge-script+56−331 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6976: Fixed Typo Errors to enhance readability within the codebase

This commit fixes five spelling mistakes in comments and documentation across the rust-bitcoin codebase. None of the changes alter program logic, data handling, or behavior. They only improve readability of text that is ignored by the comp…

1f17f0ebby Andrew Poelstra+5−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 45 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Update Google Cloud credential loading

This commit changes how BTCPay Server loads Google Cloud service-account credentials. It switches from a general Google credential parser to a more specific service-account credential parser. The change is likely a hardening or compatibili…

Credential parsing path changedNarrowing of accepted credential types to ServiceAccountCredentialPotential hardening of Google Cloud authentication flow
3f9bcabfby Nicolas Dorier+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36151: makeseeds: fix off-by-one in field count check

This is a one-line fix in a Python helper script used to build the list of network seed nodes for Bitcoin Core. The script reads lines of data about internet nodes and was supposed to skip any line that didn't have enough fields. Due to an…

Off-by-one in input validation guardIndexError aborts tool run on malformed/truncated inputFix located in non-runtime, offline seed-generation helper
8c49a9abby merge-script+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 88 · Strong
AQ ACINQEclair BitcoinLightning Network

Reject seed files with an invalid length (#3389)

This patch fixes a bug in the Eclair Bitcoin Lightning node where, if the node crashed while creating its secret seed file, it could leave an empty file behind. On the next restart, Eclair would silently use that empty seed to generate all…

Use of weak/predictable cryptographic seed for key derivationMissing input validation on security-critical seed fileNon-atomic file write creating corrupt/empty secret material
a07fff56by pm47+31−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

ignore a paynym search result that arrives after the search has changed, and stop enter replacing a pasted payment code search with its abbreviated display

This commit fixes two minor user-interface timing glitches in Sparrow Wallet's PayNym (payment-code alias) search feature. First, it ignores a search result that arrives after the user has already typed something different. Second, it prev…

UI state desynchronization between async search request and responseUser input potentially replaced by abbreviated display string on EnterPossible stale search result being rendered after user changed query
0340cdbeby Craig Raw+10−51 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →