CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24647Commits captured
21079AI analyses
58High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21079 analyses
Highest risk·RSS
Informational 12 AI analysisMessage 70 · Adequate
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Changes required due to upstream monero changes (#290)

This commit is a routine compatibility update to keep the Monero Light Wallet Server (LWS) project building against recent changes in the upstream Monero codebase. It replaces a custom macro-based type declaration (POD_CLASS) with plain C+…

No security-relevant behavioral changes in the diffChanges are limited to forward-declaration style and missing header includesNo memory safety, cryptographic, input validation, or authorization changes observed
fee43d23by Lee *!* Clagett+6−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bump build

This commit only increases the app's build number from 407 to 408 in a configuration file. It changes no code, no dependencies, and no security settings. There is no security relevance.

4a12746fby Keeqler+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Use wallet-core connection examples

This commit changes where the example server addresses come from in the wallet's connection setup screen. Previously, placeholder text like 'lws.example.com:18090' and 'node.example.com:18081' was hard-coded in the app's translation files.…

caec09b1by Keeqler+6−277 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 81 · Strong
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

Cw 1624 trezor passphrase on trezor device instead of app (#3601)

This commit adds a new option for Trezor hardware wallet users to enter their passphrase directly on the Trezor device instead of typing it into the Cake Wallet app. It also updates the pairing flow to ask users about auto-connect and pass…

Passphrase entry moved from app input field to on-device entry optionOld in-app passphrase session creation removed from wallet service and Trezor wrapperNew `TrezorPassphrase.onDevice()` and `TrezorPassphrase.value(...)` abstraction introduced via updated dependency
98f58c28by Konstantin Ullrich+741−29550 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: bump Go language and toolchain versions

This commit is a routine maintenance update that changes which version of the Go programming language is used to build the lnd project. It does not change any application logic, fix a bug, or address a security vulnerability. The project i…

b1f9ca66by ziggie+39−3930 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

Revert "fix: unify encryption across platforms (#3470)" (#3634)

This commit reverts a previous change that unified wallet file encryption across all platforms. It brings back two separate encryption paths: a newer XChaCha20-based method for direct user passwords, and an older Salsa20-based method for g…

Reverts a prior security-unification commitReintroduces Salsa20 stream cipher without authentication (no MAC)Removes wrong-password detection logic that prevented silent garbage decryption
dd58455eby Omar Hatem+86−55510 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 53 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #162 from MAGICGrants/fixes

This is a large bug-fix and refactoring update for the Skylight Wallet app. The most important security-relevant changes fix ways the app could send or store money incorrectly: amounts were being converted through imprecise 'double' number…

Fixed precision loss in cryptocurrency spend amounts by replacing double-based amount handling with exact decimal-string-to-BigInt conversionAdded unlockedBalanceBaseUnits and used it for balance validation and Max/sweep-all amount calculationMoved address book model and secure storage into shared wallet-core package with chain-keyed address map
7c132d94by Keeqler+425−92229 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/caesar): change confirm middle button

This commit changes how users confirm an Ethereum authorization screen on Trezor's 'Caesar' layout. Previously, the user had to hold down a button to approve; now a simple tap is enough. The change only affects the user-interface interacti…

UI confirmation gesture changed from hold-to-confirm to tap-to-confirmOnly affects EIP-7702 authorization flow on Caesar (T3B1) layoutTest fixture hashes updated for all supported languages
e231cc94by obrusvit+50−502 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6809: addresses: Add `AddressParams` type and remove most uses of network types

This is a routine API refactoring in the rust-bitcoin library. It introduces a new AddressParams type and replaces most public uses of the older Network/NetworkKind types when creating or validating Bitcoin addresses. There is no security …

No memory-safety issues, cryptographic errors, or input-validation changes observedNo new unsafe blocks, no new dependencies, no new parsing of untrusted dataAPI surface change only: parameter types replaced with semantically equivalent AddressParams
81032b1aby Andrew Poelstra+208−16414 files
No security note in commit
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 95 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

python client: fix three PSBTv2 defects in psbt.py

This commit fixes three bugs in a Python helper that converts modern PSBTv2 transaction data into the older PSBTv0 format used by Ledger hardware wallets. The bugs could silently corrupt the transaction's lock time and version fields durin…

Silent data corruption in transaction serialization (nLockTime, tx_version, fallback_locktime)PSBTv2 to PSBTv0 conversion path affectedPotential for producing an unsigned transaction that does not match the PSBT's declared fields
04ba9e7bby Salvatore Ingala+6−31 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →