CommitWatch RSS
ND
← Developer activityStrong match

Nicolas Dorier

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

375 commits2 monitored projects44 candidates3 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to Nicolas DorierA visual map of monitored and externally discovered repositories.NDdeveloper373BTCPay Server2Core Lightning
Monitored evidence

CommitWatch projects

BTCPay ServerBTCPay Server373 commits44 candidates3 high riskCore LightningElements Project2 commits0 candidates0 high risk
External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Informational 15 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Update Changelog

This commit only edits the wording of a changelog entry for BTCPay Server 2.4.2. It does not change any code, configuration, or executable files. The edit makes the release sound more urgent, but the commit itself is purely documentation a…

Changelog language changed to describe a critical, actively exploited vulnerability in release 2.4.2No code, configuration, or dependency changes present in the commitSecurity issue is referenced but not fixed or explained in this diff
fbf761f3by Nicolas Dorier+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Disabled unwanted routes

This commit marks several public methods on ASP.NET Core controllers with [NonAction], which prevents them from being exposed as web-accessible HTTP routes. Without this attribute, these helper methods could be reached directly via URL, po…

Public controller methods exposed as unintended HTTP routesRouting-level access-control hardeningPotential bypass of intended controller action flow
6689cad4by Nicolas Dorier+9−05 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 38 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Changelog for 2.4.2

This commit is a version bump and changelog for BTCPay Server 2.4.2. The changelog describes two security-related changes: disabling Basic authentication by default shortly after account creation, and fixing a TOTP two-factor authenticatio…

Vendor describes security fixes in changelogTOTP two-factor authentication bypass via Greenfield Basic authenticationBasic authentication disabled by default after account creation
3e2928cfby Nicolas Dorier+29−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Update translations

This commit only adds, removes, and reorders English text strings used for translations and user-interface labels in BTCPay Server. There are no code logic changes, no security settings being enabled or disabled, and no behavior changes. I…

8d5f52daby Nicolas Dorier+17−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

bump deps

This commit updates several third-party software libraries and a test Docker image to newer versions. It also removes one library (AngleSharp) that was no longer needed. Dependency updates can fix security bugs in those external packages, …

Dependency version bumps for packages that handle HTML sanitization (HtmlSanitizer) and Bitcoin protocol parsing (NBitcoin/NBXplorer)Removal of unused AngleSharp package referenceNo commit-level description of security fixes or CVEs
1c16e265by Nicolas Dorier+10−1110 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 63 · Adequate
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Disable Greenfield Basic Auth by default after 5 min of user creation (#7492)

This change is a hardening measure, not a direct bug fix. BTCPay Server now turns off username/password Basic authentication for its Greenfield API by default once an account is more than five minutes old. Users can re-enable it manually, …

Disables a less-secure authentication method by default after a short grace periodAdds per-user opt-in flag for Basic authenticationVendor explicitly frames the change as defense-in-depth following a related security fix
61cb0702by Nicolas Dorier+74−612 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 78 AI analysisMessage 75 · Adequate
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix: TOTP 2FA bypass via Greenfield Basic auth (#7491)

BTCPay Server fixed a bug where accounts protected only by TOTP-based two-factor authentication (the six-digit code from an authenticator app) could log into the Greenfield API using just their email and password, skipping the second facto…

Authentication bypass of second factor (TOTP 2FA)Incorrect authorization condition scoped only to FIDO2 credentialsAPI endpoint (Greenfield) affected by weak single-factor basic auth path
c173a919by Nicolas Dorier+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix typo

This commit changes one word in the project's changelog, adding the word 'the' to a bullet point. It is a grammatical typo fix with no effect on software behavior, security, or user data.

2ed0fa17by Nicolas Dorier+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Add race condition safe InvoiceRepository.UpdateMetadata (#7475)

This commit changes how BTCPay Server stores invoice comments and metadata. Previously, comments were saved in a separate field and could be updated with a method that was not safe when multiple requests happened at the same time. The patc…

Commit title explicitly describes a race condition fixReplaced read-modify-write metadata update with atomic PostgreSQL jsonb_set operationRemoved dedicated API 'comment' field, narrowing update surface
5664bd41by Nicolas Dorier+51−9010 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 36 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Bump anglesharp (#7476)

This commit adds a direct package reference to AngleSharp version 1.5.2 in one of BTCPay Server's project files. AngleSharp is a library for parsing HTML and other markup. The change itself is a dependency bump/addition, but the commit mes…

Dependency version change for AngleSharpNo security explanation in commit messageNo CVE or advisory referenced in commit or supplied materials
4b914484by Nicolas Dorier+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

bump HtmlSanitizer

This commit updates the HtmlSanitizer software library from version 9.0.892 to 9.0.967. HtmlSanitizer is used to clean untrusted HTML and prevent malicious content from being displayed. Version bumps of this kind are often done to fix secu…

Security-sensitive dependency updated (HtmlSanitizer)No commit-level explanation of security relevanceNo code-level changes or test cases shown
41115cd3by Nicolas Dorier+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

bump dotnet

This commit updates the .NET runtime and several Microsoft packages from version 10.0.8/10.0.9 to 10.0.10, plus a couple of minor library updates. It is a routine dependency bump with no code changes. The commit message gives no security r…

Routine dependency version bumpUpdates runtime/SDK images and framework packages to latest patch releaseNo application code changes
70257821by Nicolas Dorier+13−137 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

bump deps

This commit simply updates several third-party software libraries (dependencies) to newer patch versions. It does not change BTCPay Server's own code. Dependency bumps can fix hidden security bugs in those libraries, but the commit message…

Dependency version bumps onlyNo application code changesNo commit-level security explanation
949ed3a1by Nicolas Dorier+7−75 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 77 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Fix: SIGINT was ignored by the cln docker container

This commit fixes a Docker startup script so that when a user or system sends a shutdown signal (SIGINT/SIGTERM) to the container, Core Lightning actually receives it and shuts down cleanly. Previously the signal was ignored, which could f…

Signal handling / graceful shutdown fixDocker PID 1 signal propagation issuePotential unclean shutdown leading to state corruption
02e06fc6by Nicolas Dorier+6−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Update Changelog

This commit only edits the project's Changelog.md file, adding two missing entries that describe fixes already made elsewhere. There are no code changes in this commit itself, so it cannot introduce or fix any security issue directly.

926b87b9by Nicolas Dorier+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Small fixup

This commit is a minor cleanup: it changes how an 'empty transactions' message is created on a wallet page. Previously the message was stored as a chunk of HTML in translation files; now it is built safely in code with plain text. There is…

innerHTML replaced with safe DOM construction (textContent + createElement)Localization key changed from HTML string to plain text stringNo user-controlled input observed in the affected code path
25ac35c7by Nicolas Dorier+6−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

update translations

This commit only updates the list of translatable text strings in BTCPay Server. It adds, removes, and reorders phrases used by the application's user interface. There are no code logic changes, no security fixes, and no behavior changes.

a27f7a9aby Nicolas Dorier+69−351 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 65 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Small cleanup

This commit removes code that restricted cross-frame messaging to a specific trusted website origin. It now allows messages from any origin ('*') when sending, and only accepts messages from frames with an 'opaque' (null) origin when recei…

postMessage target origin changed from conditional origin to '*'Inbound origin check narrowed to 'null' (opaque origin)Removal of origin-derived trust decision
1dafff87by Nicolas Dorier+2−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Small code style suggestion

This commit only changes a code style setting in the project's .editorconfig file. It tells developers to prefer shorter expression-bodied method syntax when it fits on one line. There is no functional code change, no bug fix, and no secur…

dfdbea93by Nicolas Dorier+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

Improve reliability of wait_and_check_bitcoind

This change is a reliability fix for how Core Lightning waits for the Bitcoin node (bitcoind) to be ready during startup. It replaces one long 30-second wait with 30 shorter 1-second retries to avoid cases where the connection check would …

No security-relevant code path modifiedNo input parsing or authentication logic changedNo memory safety defect evident in diff
cfb877a3by Nicolas Dorier+13−21 file
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →