CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24812Commits captured
21168AI analyses
62High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21168 analyses
Highest risk·RSS
Low 30 AI analysisMessage 35 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

update mobile_app_privacy with swiftpm

This commit updates a dependency called mobile_app_privacy from version 0.0.3 to a specific commit hash (0.0.4). The change appears to be a routine dependency bump to incorporate Swift Package Manager support, but the commit message gives …

Dependency version bump to a specific commit hash rather than a release tagNo security-related language in commit title or messageNo diff content from the updated dependency itself is available
03ad8804by Julian+4−42 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

invoices: cancel only the failing AMP set on reconstruction failure

This commit fixes a bug in LND's invoice handling for reusable AMP (Atomic Multi-Path) invoices. Previously, if one payment set failed to reconstruct its preimage, the entire invoice was canceled, even though other valid payment sets on th…

Denial-of-service-like availability impact: a malicious or buggy payer could cause a whole reusable AMP invoice to be canceled, blocking legitimate concurrent payersSet-local failure incorrectly escalated to invoice-global cancellationRegression test added for concurrent-set survival after reconstruction failure
d74ab6faby Gijs van Dam+141−42 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 47 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Fix: Delete additional items

This commit fixes a bug in the wallet-deletion process. Previously, the app deleted wallet files while a background sync service still had them open in another process. That could leave deleted wallet data partially restored on disk, or ca…

Deletion of sensitive files while another isolate/process still has them openPossible resurrection/rewriting of wallet data after user-initiated deletionMissing teardown ordering between foreground service and wallet manager
6a84d569by Justin Ehrenhofer+14−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

formatting to make ci happy

This commit is purely a code-formatting cleanup. It changes whitespace, line breaks, and indentation across many Dart files so the project's automated style checks (CI) pass. No program logic, security behavior, or user-facing functionalit…

bef9da69by Julian+3154−397255 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

ios/xcode auto updated

This commit changes only the recorded dimensions of the iOS launch screen image in a storyboard file, from 512×373 to 512×512. It is a routine Xcode/auto-update style tweak with no visible security relevance.

712bd226by Julian+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

update deps and generated files to make the machines happy

This commit updates several software building blocks (dependencies) and the automatically generated code that matches them. The main change is moving the Isar database library from a pre-release test version (3.3.0-dev.2) to a stable relea…

Dependency version bump from a pre-release/dev version to a stable patch releaseRemoval of an analyzer version pin that was a known build-tool compatibility workaroundNo changes to cryptographic, wallet, storage, or network code paths
6988214eby Julian+64−9026 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 45 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet: fix inconsistent tx pubkey handling

This Monero commit fixes how the wallet handles transaction public keys and address public keys so that keys with small-order or non-standard curve points (called 'torsion' points) are normalized or rejected before being used. It also tigh…

New torsion-clearing helper for public keysAddress validation now requires main-subgroup membership and rejects identityTransaction construction rejects destinations with invalid address keys
b19cf443by selsta+130−858 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 45 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

crypto: move torsion clearing into crypto

This commit is a code cleanup: it moves the logic that removes small-subgroup 'torsion' from elliptic-curve points out of a newer, specialized module (fcmp_pp) and into the core cryptography library (crypto). The same mathematical operatio…

Torsion-clearing logic moved to shared crypto layerIdentity-point rejection preservedNo new cryptographic algorithm introduced
3becac8dby selsta+48−6510 files
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 28 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

tor native assets

This commit updates the Stack Wallet app to use a newer version of its Tor privacy plugin and switches to prebuilt native assets downloaded from GitHub. There is no direct evidence in the commit of a security vulnerability, but changing ho…

Dependency version bump for privacy-critical Tor pluginSwitch from source build to prebuilt native asset for Tor componentPrebuilt asset fetched over HTTPS from GitHub release with SHA-256 pin
bf879254by Julian+8−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 28 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

xelis native assets

This commit updates dependency versions for Xelis cryptocurrency support in Stack Wallet. It switches from the upstream xelis-flutter-ffi library to a fork maintained by Cypher Stack (the same organization as the wallet), and bumps flutter…

Dependency source changed from upstream repository to vendor-owned forkDependency version bump for flutter_rust_bridge and xelis_flutter FFINo explicit security fix, CVE reference, or vulnerability description present in commit
18289dafby Julian+16−82 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 28 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

update epiccash again

This commit simply updates the version of an external library called 'epiccash' used by the Stack Wallet app. It changes which exact code snapshot and prebuilt download the app will use, but the commit message gives no details about why th…

Dependency version bump for flutter_libepiccashPrebuilt manifest URL and SHA-256 updated to native-0.3.0No commit-level description of security relevance
bdfac9baby Julian+5−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 6 AI analysisMessage 28 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

update swb package

This commit simply updates the version of an internal backup library (stack_wallet_backup) used by the Stack Wallet app. The change points the app to a newer commit of that library and bumps its declared version from 0.0.1 to 0.1.0. There …

c9b07fbbby Julian+4−42 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →