Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →

34Projects watched

24637Commits captured

21072AI analyses

58High-risk findings · 30d

Active security advisories

Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗

Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗

Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗

The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21072 analyses

Highest risk·RSS

Low 31 AI analysisMessage 81 · Strong

3 weeks, 2 days ago

EL ElectrumElectrum BitcoinSoftware wallets

lightning: derive local channel keys instead of storing them (see #4909)

This commit refactors how Electrum stores Lightning channel keys. Instead of keeping private keys inside the channel configuration object that gets saved to disk, it now keeps only public keys there and re-derives the private keys from a c…

Reduction of persisted secret material in channel config objectsNew key-derivation path with pubkey verification on channel loadWallet database migration that removes old private key fields from existing storage

461238aaby ThomasV+350−1669 files

No security note in commit

Open full analysis →Source commit ↗

Moderate 60 AI analysisMessage 73 · Adequate

3 weeks, 2 days ago

LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11198 from gijswijs/amp-setlocal-reconstruction-fix

This change fixes a bug in LND's handling of AMP (Atomic Multi-Path) payments. Previously, if one partial payment set failed to reconstruct its secret preimage, the entire invoice was canceled, including unrelated partial payment sets from…

Denial-of-service against reusable static AMP invoices by causing unrelated accepted HTLC sets to be canceledIncorrect invoice state transition from set-local failure to global invoice cancellationAvailability impact on multi-payer AMP invoice scenarios

88959aecby Olaoluwa Osuntokun+155−44 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Low 29 AI analysisMessage 73 · Adequate

3 weeks, 2 days ago

LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11200 from ziggie1984/build-go-1.27.1

This commit updates the Go programming language version used to build LND from 1.25.13/1.26.6 to 1.26.8 (language version) and 1.27.1 (toolchain). It also regenerates many automatically generated RPC files and adjusts linter settings. The …

Go version bump may indirectly address unlisted runtime/standard-library security fixesLarge regenerated protobuf files suggest dependency/toolchain refresh rather than logic changeLinter configuration expanded to suppress new checks, consistent with a toolchain upgrade

ef4820e5by Olaoluwa Osuntokun+4932−412670 files

No security note in commit

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 0 · Opaque

3 weeks, 2 days ago

MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bump build

This commit only increases the app's internal build number from 408 to 409 in a configuration file. No code, dependencies, or security settings were changed. There is no security relevance.

e69ac4eeby Keeqler+1−11 file

No security note in commit

Open full analysis →Source commit ↗

Informational 0 AI analysisMessage 58 · Thin

3 weeks, 2 days ago

MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #166 from MAGICGrants/update-moneroc-libs

This commit only updates precompiled Monero library files (binary .so and .dll files) across Android, iOS, Linux, and Windows. No source code changes are shown, and the commit message does not describe any security fix. There is no visible…

39a3898aby Keeqler+0−07 files

No security note in commit

Open full analysis →Source commit ↗

Informational 0 AI analysisMessage 35 · Opaque

3 weeks, 2 days ago

MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

This commit updates a dependency pin for the core Monero library used by the Skylight Wallet app and switches several wallet helper packages from remote Git downloads to local file paths. The change itself is a routine dependency bump and …

Dependency pin update for core Monero cryptographic library (`monero_c`)No explicit security fix, CVE, or vulnerability description in commit message or diffWallet helper packages moved from remote Git SHA-pinned sources to local path dependencies

f8ca4c37by Keeqler+25−393 files

No security note in commit

Open full analysis →Source commit ↗

Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →

Open source.Not open secrets.

Core Lightning v26.06.9: urgent loss-of-funds security update

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

BTCPay Server: actively exploited LND credential theft

Changes worth understanding

Security should leave a paper trail.

Open source.
Not open secrets.