CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24811Commits captured
21168AI analyses
62High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21168 analyses
Highest risk·RSS
Moderate 58 AI analysisMessage 36 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

fix confirm (#7570)

This commit adds a missing safety check in the API key authorization flow. Previously, if a user clicked a 'confirm' action for an API key that no longer existed, the code would try to use a null (non-existent) key object, which could caus…

Null dereference / NullReferenceException preventedMissing validation of repository return valueUser-facing authorization flow hardening
bd7f91e2by monasco+9−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2293 from KeystoneHQ/merge/v3.1.0

This is a large firmware release merge (v3.1.0) for the Keystone 3 hardware wallet. The visible changes are mostly a major FreeRTOS kernel upgrade (from v10.x to v11.3.0), build-system improvements, and user-facing feature tweaks such as b…

FreeRTOS kernel major version upgrade (10.x -> 11.3.0) with MPU hardeningSwitch from ARM_CM4F non-MPU port to ARM_CM4_MPU portNew MPU configuration flags: configTOTAL_MPU_REGIONS=8, configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY=1, configALLOW_UNPRIVILEGED_CRITICAL_SECTIONS=0
0c0ae467by stone+59616−26981300 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #163 from MAGICGrants/conn-example-fix

This commit is a routine UI cleanup. It removes hard-coded placeholder text examples for server addresses from the app's translation files and instead asks the underlying wallet library for example addresses. There is no security-relevant …

9123a94cby Keeqler+7−288 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 70 · Adequate
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Changes required due to upstream monero changes (#290)

This commit is a routine compatibility update to keep the Monero Light Wallet Server (LWS) project building against recent changes in the upstream Monero codebase. It replaces a custom macro-based type declaration (POD_CLASS) with plain C+…

No security-relevant behavioral changes in the diffChanges are limited to forward-declaration style and missing header includesNo memory safety, cryptographic, input validation, or authorization changes observed
fee43d23by Lee *!* Clagett+6−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bump build

This commit only increases the app's build number from 407 to 408 in a configuration file. It changes no code, no dependencies, and no security settings. There is no security relevance.

4a12746fby Keeqler+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Use wallet-core connection examples

This commit changes where the example server addresses come from in the wallet's connection setup screen. Previously, placeholder text like 'lws.example.com:18090' and 'node.example.com:18081' was hard-coded in the app's translation files.…

caec09b1by Keeqler+6−277 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6897: consensus_encoding: fix overcounting bug in the composite encoders exact size len calculation

This commit fixes a counting bug in a Rust Bitcoin library. The library has combined encoders that bundle multiple pieces of data together. A method called len() is supposed to report how many bytes are left to encode, but it was incorrect…

Violation of documented API contract (ExactSizeEncoder::len)Potential incorrect buffer-size or progress decisions by downstream callersComposite encoder state not fully isolated in size reporting before fix
22bbc326by Andrew Poelstra+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 81 · Strong
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

Cw 1624 trezor passphrase on trezor device instead of app (#3601)

This commit adds a new option for Trezor hardware wallet users to enter their passphrase directly on the Trezor device instead of typing it into the Cake Wallet app. It also updates the pairing flow to ask users about auto-connect and pass…

Passphrase entry moved from app input field to on-device entry optionOld in-app passphrase session creation removed from wallet service and Trezor wrapperNew `TrezorPassphrase.onDevice()` and `TrezorPassphrase.value(...)` abstraction introduced via updated dependency
98f58c28by Konstantin Ullrich+741−29550 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: bump Go language and toolchain versions

This commit is a routine maintenance update that changes which version of the Go programming language is used to build the lnd project. It does not change any application logic, fix a bug, or address a security vulnerability. The project i…

b1f9ca66by ziggie+39−3930 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

Revert "fix: unify encryption across platforms (#3470)" (#3634)

This commit reverts a previous change that unified wallet file encryption across all platforms. It brings back two separate encryption paths: a newer XChaCha20-based method for direct user passwords, and an older Salsa20-based method for g…

Reverts a prior security-unification commitReintroduces Salsa20 stream cipher without authentication (no MAC)Removes wrong-password detection logic that prevented silent garbage decryption
dd58455eby Omar Hatem+86−55510 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: fix bug in the composite encoder's exact size

This commit fixes a bookkeeping bug in a Rust Bitcoin library's composite encoder. The encoder is a tool that combines multiple pieces of data into a single byte stream, and it has a method that is supposed to report how many bytes are lef…

Incorrect implementation of a documented size/length contractPotential for callers to over-allocate buffers or miscompute transaction/witness sizesComposite encoder used in consensus-critical serialization paths
914365b4by Nick Johnson+19−13 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 53 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #162 from MAGICGrants/fixes

This is a large bug-fix and refactoring update for the Skylight Wallet app. The most important security-relevant changes fix ways the app could send or store money incorrectly: amounts were being converted through imprecise 'double' number…

Fixed precision loss in cryptocurrency spend amounts by replacing double-based amount handling with exact decimal-string-to-BigInt conversionAdded unlockedBalanceBaseUnits and used it for balance validation and Max/sweep-all amount calculationMoved address book model and secure storage into shared wallet-core package with chain-keyed address map
7c132d94by Keeqler+425−92229 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →