CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24877Commits captured
21196AI analyses
59High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21196 analyses
Highest risk·RSS
Low 42 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

libjade: enable sensitive.c

This commit re-enables a previously disabled security module called sensitive.c in the libjade (non-embedded) build. It also adds proper cleanup of thread-local storage so that sensitive data is cleared when the Jade firmware stops and res…

Re-enables real sensitive memory tracking/clearing in libjade buildsAdds thread-local storage cleanup callbacks to prevent stale sensitive pointersAdds startup assertion that TLS is empty, catching missed cleanup
748f9d00by Daniel Newton+99−194 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6847: Manual weekly update to rustc (to nightly-2026-09-05) on master

This is a routine maintenance update that switches the project's pinned nightly Rust compiler version and makes the small code changes needed to keep the project compiling cleanly under the new compiler and its updated linting/formatting r…

cb240433by Andrew Poelstra+47−488 files
No security note in commit
Open full analysis →Source commit ↗
Informational 3 AI analysisMessage 35 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Update monero_c libraries

This commit swaps out precompiled Monero wallet library files for newer versions across Android, iOS, Linux, and Windows. The only human-readable change is updating the iOS framework's bundle identifier from 'com.skylight.MoneroWallet' to …

Binary-only update of core wallet library (monero_c / libwallet2_api_c)No source diff, patch notes, or vulnerability description present in commitiOS bundle identifier changed from com.skylight.MoneroWallet to org.magicgrants.MoneroWallet
59fae2b2by Keeqler+4−411 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Serialize transient Event variants; move persist decision into ChannelManager' (#4791)

This commit changes how LDK stores pending event notifications. It adds serialization support for several event types that previously were not fully saved to disk, and introduces a helper method so the code can decide which events are wort…

Data-loss prevention: previously non-round-trippable event variants are now fully serialized, avoiding accidental event loss when users serialize Event queues themselvesState-consistency hardening: ChannelManager now explicitly skips events that describe non-surviving restart state, preventing replay of stale eventsDefensive assertion: debug builds assert that every persisted event round-trips to Some(event), catching serialization mismatches
a0d4632eby Matt Corallo+694−818 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

mwc native assets package migration (removes need for submodule and fixes issue on macos)

This commit changes how the Mimblewimblecoin (MWC) crypto library is bundled in the Stack Wallet app. It removes the old Git submodule setup and instead pulls the library directly from a specific Git commit. It also re-enables MWC support …

External dependency now fetched by Git commit hash rather than local submoduleRemoval of MWC build-commit verification UI and GitStatus commit-status checksRemoval of getPluginVersion() from LibMwcInterface
2509dd9eby Julian+311−45311 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

SFT-8098: skip change verification for transactions without change

This commit changes how the Passport hardware wallet reviews Bitcoin transactions that have no 'change' output. Previously, the wallet would always run a change-verification step that opens the secure key store, even when there was no chan…

Change reduces unnecessary access to the key store during transaction reviewNo cryptographic check is removed for transactions that actually contain changeUI label changed to more accurately describe the operation being performed
3df93748by Jacksper13+36−112 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

SFT-8098: complete change verification before transaction review

This commit moves a safety check earlier in the process of approving a Bitcoin transaction on the Passport hardware wallet. Previously, the wallet verified that 'change' outputs (money going back to your own wallet) truly belonged to you o…

Change-address verification moved from post-approval signing stage to pre-review stagePSBT change output ownership now proved before user is shown transaction detailsSensitive key derivation context closed before transaction review is displayed
fb88001cby Jacksper13+150−464 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
SS SeedSignerSeedSigner BitcoinHardware wallets

Rename is_change to is_presumed_change

This commit only renames a variable from 'is_change' to 'is_presumed_change' and updates comments/docstrings to make it clearer that multisig outputs are only suspected—not proven—to belong to the user's wallet. The code logic is unchanged…

No functional code changeVariable rename and documentation clarification onlyCommit message explicitly states 'No behavior change'
321bf14dby kdmukai+19−131 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 83 · Strong
SS SeedSignerSeedSigner BitcoinHardware wallets

Match policy types exactly and refuse an unsupported one

This commit fixes a bug in how SeedSigner parses Bitcoin transaction outputs. Previously, the code guessed script types using partial string matches (like checking if 'pkh' appears anywhere in the type name) and had no fallback for unknown…

CWE-20: Improper Input Validation - substring matching allowed ambiguous/unsupported script type handlingCWE-248: Uncaught Exception - unsupported script types caused bare TypeError instead of controlled failureCWE-754: Improper Check for Unusual or Exceptional Conditions - missing else branch for unsupported policy types
a929b8b3by kdmukai+38−112 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10737 from sashazykov/hw-close-wallet-thread-leak

This commit fixes a shutdown bug in Electrum's hardware wallet support. Previously, if disconnecting from a hardware wallet failed, the cleanup thread could keep running, which could crash the application when closing. The fix stops the th…

Process abort/crash at shutdown due to leaked QThreadException during cleanup not handled, potentially causing abnormal terminationHardware wallet client close made best-effort with error logging
5b77ca46by Felix+9−22 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 85 · Strong
SS SeedSignerSeedSigner BitcoinHardware wallets

Set is_change only after each branch's own checks

This commit fixes a logic bug in how SeedSigner decides whether a Bitcoin transaction output is 'change' coming back to the user's wallet. Previously, the code marked an output as change as soon as it looked like it paid to the user's seed…

Logic bug: default-true flag inside a conditional arm with branches responsible for undoing itPotential UI deception: unverified output could be displayed as user changeDefensive refactor: flag set only after branch-specific verification
12c72391by kdmukai+23−71 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10958 from SomberNight/202609_deps

This commit is a routine dependency update for the Electrum Bitcoin wallet. It bumps versions of Python, OpenSSL, secp256k1, and various Python packages used in builds and runtime. The commit itself does not fix any known security bug in E…

Dependency version bumps for cryptographic libraries (OpenSSL, libsecp256k1, electrum-ecc)Routine maintenance commit with no explicit security claimHash-only changes in deterministic requirements files
8bd8c3fbby ghost43+57−5612 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →