CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24369Commits captured
20930AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

20930 analyses
Highest risk·RSS
High 77 AI analysisMessage 63 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11155

This patch tightens validation of Monero 'key images'—the special values that prevent the same coin from being spent twice. Before the change, a malformed key image that was either the identity point or had a small-order/torsion component …

Adds subgroup-order check for key images in ring signature verificationRejects identity element as a valid key imageExposes curve order constant sc_l for scalar multiplication checks
1add2d74by tobtoht+11−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Merge commit 'refs/pull/2123/head' of https://github.com/BitBoxSwiss/bitbox02-firmware

This commit only adds two digital signature files for an already-released firmware version (v9.25.0). These are third-party reproducible-build assertions by a user named 'yaziza', not changes to the firmware source code. There is no code c…

b8bbbb64by Marko Bencun+0−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 58 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Merge commit 'refs/pull/2124/head' of https://github.com/BitBoxSwiss/bitbox02-firmware

This commit only adds two digital signature files for an already-released firmware version (v9.27.1). These are release attestation signatures from a contributor named 'yaziza'. There is no code change, no firmware change, and nothing in t…

392ac2ffby Marko Bencun+0−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Merge branch 'nickez/bb02-finalize-elf'

This commit is a build-system refactor that unifies how firmware image headers are generated for the BitBox02 and BitBox03. It replaces a device-specific Python script and a C header placeholder with a shared Python tool and JSON manifests…

New input validation in image_header.py for magic, flags, product_id, monotonic_version, marketing_version, image length, and zeroed signature slotsRust parsing now validates slot length, header length alignment, and image length bounds before deriving code lengthRemoval of prepare-stage1-unsigned path reduces attack surface in build tooling
810d3e87by Niklas Dusenlund+573−14413 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 68 AI analysisMessage 85 · Strong
SS SeedSignerSeedSigner BitcoinHardware wallets

Admit bare p2sh outputs as nested single sig change

This commit fixes a bug in SeedSigner's PSBT transaction parser. When a user spent from a 'nested single-signature SegWit' wallet (p2sh-p2wpkh), a change output could omit an optional redeem script. The parser then misread the output as a …

UI misrepresentation: user's own change displayed as external paymentMissing ownership-contradiction check on crafted PSBT outputOptional BIP-174 field used as policy discriminator, causing type mismatch
cf18a0b9by kdmukai+77−152 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
SS SeedSignerSeedSigner BitcoinHardware wallets

Trivial comment typo fix

This commit fixes a single typo in a comment inside a test file. It changes 'Prep the our modified psbt in embit' to 'Prep the modified psbt in embit'. There is no code, logic, or security change whatsoever.

74cf6924by kdmukai+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6898: Release tracking PR: `consensus-encoding 1.3.0`

This is a routine release-management commit that bumps the version number of the `bitcoin-consensus-encoding` crate from 1.2.0 to 1.3.0 and updates lock files accordingly. It contains no code changes that fix or introduce a security issue.…

0cfc7908by Andrew Poelstra+37−349 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): sync Crowdin translations

This commit is a routine synchronization of translated user-interface text strings from the Crowdin translation platform into the Trezor firmware. It only changes wording, grammar, and layout labels in multiple language files (Czech, Germa…

b0c2a4ceby Michal Kazda+944−7747 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11033

This change fixes a privacy leak in Monero's restricted RPC mode. When a node operator enabled restricted RPC (used for public RPC endpoints), the get_block_template RPC call could still include sensitive transactions—specifically Dandelio…

Privacy leak in restricted RPC: sensitive unbroadcast/stem transactions exposed via get_block_templateNew include_sensitive flag defaults to true but forced false for restricted RPC contextsBlock template cache keyed on include_sensitive to avoid cross-context cache reuse
ca98e4faby tobtoht+26−218 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

assets: clean rsFIRO SVGs with svgcleaner

This commit simply runs a cleanup tool on three SVG image files used for the rsFIRO cryptocurrency icon. It removes unnecessary formatting and metadata from the image files without changing their visual appearance. There is no security rel…

570e3e2aby Reuben Yap+3−333 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge staging and keep the upstream CI workflow

This commit is a routine merge from a staging branch that mostly tidies up build scripts and CI. The only user-visible change is that the Firo wallet now groups 'revoked' and 'banned' masternodes together under a single red 'banned' label,…

Dependency version bump for mobile_app_privacy (git ref changed).gitignore relaxation for cs_monero build artifacts and diff filesCI/build scripts now auto-generate API key template with additional Trocador placeholders
2dbadce6by Reuben Yap+63−1610 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →