CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24267Commits captured
20890AI analyses
58High-risk findings · 30d
Active security advisories
High

Core Lightning: disable experimental features immediately

Core Lightning is investigating a potential issue affecting experimental features that may impact user funds. The vendor urges every Core Lightning operator running experimental features to disable them immediately.

Affected: Core Lightning nodes with one or more experimental features enabled. The vendor has not yet identified the affected feature, versions, trigger, or whether exploitation or fund loss has occurred.

Action: Follow the vendor instruction and disable all experimental features immediately. Check lightningd configuration and startup arguments for experimental options, restart with them disabled, and do not re-enable them until Core Lightning publishes further guidance.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

20890 analyses
Highest risk·RSS
Low 42 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: trim stale transfer maps after output imports

This Monero wallet patch cleans up internal lookup tables (key-image and public-key indexes) when the list of owned transaction outputs is shrunk, for example during an output import. Without the cleanup, those indexes could point to entri…

Out-of-bounds index retained in wallet lookup maps after container shrinkPotential wallet crash or incorrect spend selection due to stale key-image / public-key mappingRepair-on-load for legacy wallet caches that predate the fix
80f75eaaby selsta+29−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

simplewallet: classify payment IDs by their payload

This small change removes a consistency check in Monero's command-line wallet when loading a saved transaction. Previously, the wallet verified that a 'dummy' payment ID label matched a special zero-value payment ID. Now it labels the paym…

Removal of a CHECK_AND_ASSERT_MES consistency checkRemoval of integrated-address validation for payment ID classificationChange in UI/labeling logic for loaded transactions
5937d5cfby selsta+1−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11161

This commit updates Monero's built-in blockchain checkpoints to match the v0.18.5.3 release. Checkpoints are hard-coded reference points that help nodes quickly verify they are following the correct chain and resist certain attacks. The ch…

Hard-coded blockchain checkpoint data updated to a newer height/hashExpected compiled-in block hashes digest changedNo new code paths, cryptographic changes, or bug fixes visible in the diff
b0a9d51eby tobtoht+7−74 files
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11448

This is a small code fix in Monero's wallet that keeps the recorded breakdown of received amounts consistent when a transaction output is 'burnt' (replaced or spent as part of a transaction the wallet is processing). The change adds a chec…

Defensive consistency check added (THROW_WALLET_EXCEPTION_IF)Fixes internal accounting of received output amountsNo explicit security claim in commit or supplied references
24a01223by tobtoht+7−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11443

This patch fixes a spot in the Monero wallet where an untrusted remote server (daemon) could supply a misleading 'status' field. Previously, the wallet used that raw status directly in its error handling, which could potentially make a mal…

Untrusted input from remote daemon used in error-handling pathMissing trust check on daemon-reported RPC statusSingle-call-site hardening patch
c03c1f15by tobtoht+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11406

This commit adds two new read-only options to the wallet's remote procedure call (RPC) interface so users can request their public view key and public spend key. Public keys are meant to be shared openly and are not secrets, so exposing th…

717a4235by tobtoht+17−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11394

This commit only updates a submodule pointer for the external polyseed library from one commit hash to another. The actual code changes inside the submodule are not shown in the diff, and no public references were supplied. There is no vis…

c437e73fby tobtoht+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11391

This patch fixes a size-limit accounting bug in Monero's built-in HTTP server. When a client sends multiple HTTP requests back-to-back on the same connection (pipelining), leftover buffered data from the next request was not being counted …

Request size limit bypass via pipelined HTTP cachingDenial-of-service / memory pressure potential from oversized requestsFix in low-level network protocol handler
9b24b744by tobtoht+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11386

This patch fixes a privacy leak in Monero's wallet RPC server. Previously, the --no-dns flag was ignored when no wallet was loaded, so the validate_address RPC call could still perform a DNS lookup (OpenAlias) even though the user had expl…

Privacy leak: RPC ignored --no-dns when no wallet loadedDNS lookup performed despite explicit user opt-outOpenAlias resolution could disclose queried addresses/aliases to DNS resolvers
9df95286by tobtoht+33−25 files
No security note in commit
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11385

This commit adds cleanup of three additional memory buffers in Monero's seed-phrase key-stretching code. Before the change, leftover copies of intermediate secrets could remain in stack memory after the function finished. An attacker who c…

Sensitive intermediate key material left in stack memory after function returnUse of sodium_memzero to clear cryptographic buffersPBKDF2 implementation handling mnemonic-derived secrets
1cd8ae93by tobtoht+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11383

This update improves the Monero wallet's command that connects to a network node (daemon). It lets users supply a username/password and a proxy address when switching daemons, and it replaces an older one-step connection method with a newe…

Added mutex lock in wallet2::set_proxy to protect concurrent access to proxy and HTTP client stateset_daemon now passes RPC login credentials and proxy settings through the proper wallet2::set_daemon APITrust heuristic changed to only auto-trust local daemons when no proxy is in use
07e23b8fby tobtoht+78−172 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 58 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Merge pull request #11253

This change alters how Monero creates a view-only wallet copy. Previously, the code exported outputs using a method that could strip some metadata. Now it copies the full internal transfer records directly, then wipes and clears the multi-…

Sensitive field sanitization before export (memwipe + clear of m_multisig_k)Change in data export path for view-only wallet creationPreservation of 'complete output metadata' implying previous path was incomplete
ff738959by tobtoht+9−31 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →