CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24880Commits captured
21196AI analyses
59High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21196 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 50 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Pin Rust toolchain to 1.96 via single-source rust-toolchain.toml

This commit is a build-maintenance change, not a security fix. It creates one central file (rust-toolchain.toml) that declares which Rust compiler version to use, and updates build scripts and Docker configuration to read from that file in…

4685ba67by Keeqler+24−97 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: minor speedups

This is a small performance cleanup in Monero's wallet code. It replaces two unnecessary copies of transaction lists with references, and switches one lookup from a two-step 'check then fetch' to a single map lookup. There is no security i…

7a6d7c2fby jpk68+4−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 86 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcserver: test null getblock verbosity

This commit only adds a new integration test that sends a null value for the optional verbosity parameter of the getblock RPC and checks that the server returns a normal verbose block response. It does not change any production code. The t…

Regression test for a prior RPC server panic (#2600)No production code changes; defensive test coverage only
c130f0bfby Olaoluwa Osuntokun+36−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 65 AI analysisMessage 73 · Adequate
BT btcsuitebtcd BitcoinNode implementations

Merge pull request #2600 from allocz/fix_issue_2597

This patch fixes a server crash in btcd's JSON-RPC 'getblock' command. When a caller did not provide an optional 'verbosity' parameter, the code later dereferenced a nil pointer, causing the entire btcd process to panic. The fix supplies a…

nil-pointer dereference panic in RPC handlerdenial-of-service via crafted JSON-RPC requestserver process crash (availability impact)
a3f20384by Olaoluwa Osuntokun+5−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 6 AI analysisMessage 28 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bump and update pins

This commit simply updates version numbers and switches several software dependencies to newer pinned versions. There is no visible code change in the app itself, and the commit message gives no indication that any security problem is bein…

6fd9bf0bby Keeqler+12−123 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 15 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

qrmode: clean temporary buffer

This commit adds cleanup of a temporary memory buffer used when turning data into QR codes on the Blockstream Jade hardware wallet. The buffer could previously remain in memory after use, potentially leaving sensitive QR data behind for la…

Sensitive temporary buffer not cleared before fixUse of SENSITIVE_PUSH/SENSITIVE_POP memory-clearing macrosQR payload data may include private or confidential material
34f68c20by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

internals: Escape control chars in parse errors

This commit fixes a log-injection-style issue in error messages. When the library failed to parse a string, it would print the user's raw input directly into the error text. If that input contained hidden control characters such as newline…

Control characters rendered verbatim in error outputLog/output injection risk from attacker-controlled inputUse of escape_debug to sanitize untrusted string content
ef30002bby Jamil Lambert, PhD+2−21 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 60 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

rpc: add network type to get_version response

This commit adds a small convenience feature to Monero's remote procedure call (RPC) interface: the get_version response now tells callers which network the node is running on (mainnet, testnet, stagenet, fakechain, or unknown). It also re…

c4cf74b3by jpk68+29−34 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Merge remote-tracking branch 'agent/benma-agent/bootloader-descriptor-compat'

This commit relaxes a version check in the BitBox02 bootloader upgrade code. Previously, the firmware installer required that a stage0 bootloader descriptor's version exactly matched the currently expected image version. Now it accepts des…

Strict version equality check removed from bootloader descriptor parsingChange located in bootloader upgrade / firmware installer verification pathNo bounds, length, or pointer validation changes observed
6dccfd24by Marko Bencun+19−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bring improvements from spice

This commit is a routine product update that brings user-interface improvements from another wallet project ("spice") into Skylight Wallet. It changes labels and help text, updates the address-book design, adds a language picker to the wel…

f1ed0e19by Keeqler+382−23016 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

bolt12: describe the lnwire dependency

This is a documentation-only change. A package comment was updated to accurately describe that the bolt12 codec library does depend on LND's lnwire package for low-level message types, while clarifying it still does not interact with the r…

5f53171dby bitromortac+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 91 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: cover the amount overflow guard

This commit adds a test to ensure that when a BOLT 12 invoice is validated against a request, the multiplication of the offer amount by the requested quantity cannot overflow and wrap around to zero. Without this guard, a malicious or malf…

Integer overflow / wraparound in amount calculationMissing test coverage for security-critical branchBOLT 12 invoice amount validation
3c8e2bcbby bitromortac+47−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →