CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24812Commits captured
21168AI analyses
62High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21168 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: update ci

This commit only updates a Git submodule pointer (keystone3-firmware-release) from one commit hash to another. No source code, build scripts, CI configuration, or security-related files are changed in the visible diff. There is no evidence…

a7f6db29by Soralit+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

release 3.1.0

This is a large firmware release commit (version 3.1.0) for the Keystone 3 hardware wallet. The most significant change visible in the diff is a major upgrade of the FreeRTOS real-time operating system kernel from version 10.x to 11.3.0, c…

FreeRTOS major version upgrade (10.x → 11.3.0) with MPU port enabledNew MPU sandbox task/runtime/validator files addedconfigENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY=1 and configALLOW_UNPRIVILEGED_CRITICAL_SECTIONS=0 set
2b007a29by Soralit+59615−26980300 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

use a framerate-capped interpolated timeline for the server toggle and wallet tab loading pulse animations, and stop any running server toggle pulse before starting a new one

This commit tweaks two visual animations in the Sparrow Wallet desktop app: the server connection toggle pulse and the wallet loading pulse. It caps how often the screen is redrawn during the pulse and makes sure any already-running pulse …

Resource-consumption / performance hardening: capped animation framerate reduces CPU/GPU load from continuous 60 Hz redraws.State-management hardening: stopping an existing pulse before starting a new one prevents accumulation of running Timelines.No direct security flaw is present in the diff; signals are defensive-hardening in nature.
4da29f4eby Craig Raw+7−132 files
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6886: units: preserve original err summing `NumOpResult`

This patch fixes a bug in how rust-bitcoin adds up a list of numeric operation results. Previously, if any item in the list already carried an error (for example, dividing by zero), the summing code would overwrite that error and falsely r…

Error-type confusion / misattribution in arithmetic result aggregationLoss of original failure context across iterator foldPotential for downstream logic to act on wrong `MathOp`/`MathErrorKind`
4af1ee1dby Andrew Poelstra+23−191 file
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

cut pasted amounts to the unit precision in the send tab and send to many, and stop the csv import skipping fractional sats and exponent amounts

This commit fixes how Sparrow Wallet handles pasted or imported Bitcoin amounts. Previously, very small or oddly formatted amounts (like scientific notation '1e-8' or fractional satoshis) could be misread or silently skipped during CSV imp…

Amount parsing inconsistency between UI paste and CSV importSilent swallowing of NumberFormatException could skip payment rowsUse of Double.parseDouble for monetary amounts
9e999d3fby Craig Raw+39−362 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): name multisig accounts

This commit is a user-interface improvement for the Trezor hardware wallet. It gives on-screen names to certain Bitcoin multisig account types (BIP-45, BIP-48, Casa, Unchained, GreenAddress) that previously showed up as "Unknown path." It …

UI-only labeling change; no cryptographic or authorization logic modifiedNo new path validation rules; existing `PathSchema` matching is reusedExport points remain forbidden by default safety checks in `get_address()`
f4219709by Petr Susil+566−687 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge release v3.0.8 (#2291)

This commit is a routine version-bump merge for release v3.0.8. It only updates changelogs, a Git submodule pointer, and a build version number. There is no code change visible in the diff and nothing that suggests a security fix or vulner…

b5e8f9fcby github-actions[bot]+18−24 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 28 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Improve decimal handling

This commit fixes a Monero wallet bug where the amount a user wanted to send could silently change because the app was converting the typed amount into a 'double' (a computer number format with limited precision) before turning it into the…

Precision loss in financial amount conversion (double -> base units)Silent amount truncation in transaction creationPotential incorrect fee estimation due to amount rounding
87f84ae1by Justin Ehrenhofer+53−543 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6618: ci: disable fail-fast in weekly rustc update crons

This commit changes two GitHub Actions workflow files used for weekly automated Rust toolchain updates. It adds `fail-fast: false` so that if one branch's update job fails, the other branch jobs continue running instead of all being cancel…

c0a70548by Andrew Poelstra+2−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#34861: wallet: Add importdescriptors interface

This commit refactors Bitcoin Core's wallet descriptor import feature so the same logic can be used by both the RPC command and a new GUI-facing interface. It also tightens one input rule: negative timestamps are now rejected, and the mini…

Refactor of security-sensitive wallet import code into shared CWallet pathNew input validation: negative timestamps rejected for importdescriptorsCentralization of descriptor range bound checks in CheckDescriptorRangeBounds
2bbbeaa6by Ava Chow+619−26415 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: preserve required SSL when allowing chained certificates

This small patch fixes a logic bug in how the Monero wallet decides whether SSL/TLS is required when connecting to a daemon. Previously, the wallet only treated SSL as required when the user explicitly pinned a specific certificate ('user_…

Logic bug in SSL requirement determinationCustom CA / fingerprint paths did not force SSL enforcementPotential silent downgrade from intended encrypted connection
27c443c8by selsta+3−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 93 · Strong
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

feat: restrict history api calls when toggle is off in privacy settings (#3615)

This commit adds a privacy toggle that stops EVM and Tron wallets from calling third-party blockchain history APIs (like Etherscan, PolygonScan, TronGrid) when the user turns the feature off in privacy settings. It also fixes preference ke…

Privacy leak mitigation: prevents address/transaction history disclosure to third-party scan providers when user disables the optionPreference key mismatch fix: old keys `use_basescan`/`use_arbiscan` did not align with documented/expected keys, so toggles may have been ineffectiveFail-closed behavior: `checkIfScanProviderIsEnabled()` returns `false` on SharedPreferences read errors
3a04c7ffby David Adegoke+36−106 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →