CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24877Commits captured
21196AI analyses
59High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21196 analyses
Highest risk·RSS
Low 34 AI analysisMessage 100 · Strong
SS SeedSignerSeedSigner BitcoinHardware wallets

Compare cosigners before presuming multisig change

This commit tightens how SeedSigner decides whether a multisig payment back to the user is real 'change' or actually a payment to a different wallet. Before, if an output contained the user's key and looked like the same kind of multisig (…

Multisig change-output presumption logic changed to compare input vs output cosigner listsOptional/unauthenticated PSBT global xpubs used only as a hygiene check, not a hard security controlMismatch demotes output from change to spend rather than raising an error
ff133966by kdmukai+244−62 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 78 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

CW-1468 Home Screen Top Bar Layout (#3576)

This commit is a routine user-interface redesign for the Cake Wallet home screen. It moves the wallet name and account customizer into a new top bar, adds an 'Accounts' entry in settings, and adds or updates widget tests. There is no indic…

5b0f0fcdby Patrick+1260−33617 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35935: wallet: Avoid unnecessary wtxvariant rewrites

This is a Bitcoin Core wallet code cleanup, not a security fix. It changes how transaction records are written to the wallet database so that the program only rewrites the parts that actually changed, rather than rewriting everything each …

Refactor of wallet persistence layer to avoid redundant database writesAdds explicit error handling for database write failures in CWalletTx::UpdateNo change to cryptographic validation, consensus rules, or network handling
0476444eby merge-script+48−256 files
No security note in commit
Open full analysis →Source commit ↗
High 74 AI analysisMessage 45 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Unify lock requests between apps

This commit fixes two real security gaps in a mobile cryptocurrency wallet. First, when the app was sent to the background and later reopened, it could return to an already-unlocked wallet with the password still in memory, letting anyone …

Background-resume bypass of app lock with password remaining in memorySeed phrase / secret spend key exposure without additional authenticationAddition of biometric gating before seed reveal
e00c311eby Justin Ehrenhofer+86−78 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

blockchain_db: remove redundant comments

This commit only removes eight short inline comments from a header file because equivalent descriptions already exist as formal documentation comments directly beneath each one. There are no code, logic, or security changes.

3a5d6f25by jpk68+0−81 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 28 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Add QR restore

This commit removes a local QR-restore parser and switches the wallet to use a shared parser from another package. It also fixes two unrelated bugs in the send screen: one that could permanently block fee estimates after a single failure, …

Parser logic moved to an external package (wallet_domain) without showing the new implementationOld parser used Uri.decodeQueryComponent with a fallback on failure; new parser behavior is not visible in this commitNo input validation or sanitization changes are visible in the consuming code
d9690c4eby Justin Ehrenhofer+26−623 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Support Face ID

This commit adds Face ID and Touch ID support to unlock the Skylight Wallet app on iOS. It is a feature addition, not a security fix. There is no evidence in the commit of a vulnerability, bug, or security-relevant change beyond normal bio…

3af605e7by Justin Ehrenhofer+58−17 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6856: hashes: Fix Hkdf::expand panic

This commit fixes a panic (sudden crash) in the HKDF key-derivation function when a caller asks for the maximum allowed output length. The previous code used an 8-bit counter that overflowed on the final block, causing the program to abort…

Integer overflow in block counter leading to runtime panicDenial-of-service vector via a valid, maximum-length HKDF expand requestViolation of RFC-5869 maximum output guarantee
4cc6f0d2by Andrew Poelstra+28−121 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 45 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Improve toast and fix secure clipboard

This commit fixes a security bug in how the Skylight Wallet app copies sensitive information to the clipboard. Previously, some screens copied wallet addresses and secret keys using the regular system clipboard, which could leave that data…

Sensitive data (addresses, keys) was copied via the regular system clipboard on some screensPatch routes those copies through SecureClipboard.copy(), which likely sets ClipDescription.EXTRA_IS_SENSITIVE and auto-clearsAndroid 13+ duplicate clipboard confirmation is suppressed to avoid UX leakage
b898f192by Justin Ehrenhofer+46−7415 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 76 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: check expiry bounds in createinvoice too

This commit fixes a bug in Core Lightning's createinvoice RPC. A malicious or malformed BOLT11 invoice could include an expiry time of 2^32 seconds or more. Because createinvoice decoded the invoice without checking signature validity, it …

Denial-of-service vector: malformed input can crash daemon or cause busy-loopInput validation gap: signature-not-required decode path bypasses existing expiry boundInteger/overflow-related failure: expiry timer overflow at large values
6882d164by Amperstrand+56−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 35 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Fix keyboard covering setting

This commit fixes a user-interface bug in the wallet's settings screen. Previously, when the on-screen keyboard appeared, it could cover the bottom of a settings form because the popup sheet was sized using the full screen height. The chan…

02de68b0by Justin Ehrenhofer+7−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Update Skylight strings

This commit only changes user-facing text strings in the Skylight Wallet app. It updates labels, descriptions, and warnings shown to users in English and Portuguese to be clearer and more informative about privacy and security risks. No co…

83affa51by Justin Ehrenhofer+82−825 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →