CommitWatch RSS
LWS
← All projectsMonero LWS

Monero LWS

Light-wallet server indexing Monero chain data for remote wallet clients.

Indexing infrastructureMoneroPrivacy protocolsNormal
Source repository ↗
Repository coverage

108 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

10security candidates25second-pass queue35AI analyses
18commits · 30 days
24commits · 60 days
62commits · 180 days
108commits · 365 days
Backfill bands
Sep 27 → Mar 3144 seen3 candidatesComplete
Mar 31 → Jul 2932 seen4 candidatesComplete
Jul 29 → Aug 2812 seen2 candidatesComplete
Aug 28 → Sep 276 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

50/100 average clarity
1Strong · 80–100
8Adequate · 60–79
83Thin · 40–59
16Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Lee *!* Clagett95934149
Evgeny211062
jpk68300057
everoddandeven300056
Lee Clagett300047
Paul V Puey100076
William Swanson100066
Analysis record

Published AI watches

Last scanned 36 minutes ago

High 71 AI analysisMessage 81 · Strong
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fixes for issues reported by llm (#297)

This commit fixes nine separate bugs in the Monero Light Wallet Server (LWS). The most serious ones are: an infinite loop when importing certain address data, a missing size limit that let unauthenticated remote clients request huge amount…

Infinite loop in database import path (DoS)Missing authentication-time message size limit on remote scanner protocol (memory exhaustion / DoS)Untrusted array reads from client in light wallet RPC
81451fb2by Lee *!* Clagett+62−129 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker build:

This commit fixes a broken GitHub Actions workflow file that builds and publishes Docker images. It corrects a variable name (from 'platform' to 'arch') and adds a missing period at the end of the docker build command. There is no security…

10118fbdby Lee *!* Clagett+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker action file

This commit fixes a YAML indentation error in a GitHub Actions workflow file. It changes one line of spacing so the Docker login step is correctly aligned under the job's steps list. There is no security-relevant change to the software its…

bff4b1b4by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker build command

This commit fixes a typo in a GitHub Actions workflow file. The Docker build command had an extra word ('build build') that would cause the automated Docker image build to fail. It is a routine CI/CD fix with no security relevance.

e5d4b3a7by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker build matrix

This commit fixes a GitHub Actions workflow syntax error. The 'matrix' keyword was missing its required parent 'strategy' wrapper, which would prevent Docker build jobs from running correctly. There is no security relevance in the code cha…

800e026fby Lee *!* Clagett+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 70 · Adequate
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Changes required due to upstream monero changes (#290)

This commit is a routine compatibility update to keep the Monero Light Wallet Server (LWS) project building against recent changes in the upstream Monero codebase. It replaces a custom macro-based type declaration (POD_CLASS) with plain C+…

No security-relevant behavioral changes in the diffChanges are limited to forward-declaration style and missing header includesNo memory safety, cryptographic, input validation, or authorization changes observed
fee43d23by Lee *!* Clagett+6−55 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 58 · Thin
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix LMDB (wrong) context cast, and remove now unnecessary LMDB code (#287)

This commit fixes a type-casting mistake in the Monero Light Wallet Server's database code. The program was treating its own custom database context as a different, more generic context. That mismatch could corrupt internal accounting of a…

Wrong context cast in LMDB transaction cleanup (type confusion)Custom context reference counting could be corrupted by mismatched deleterLarge code removal reduces attack surface and eliminates duplicated LMDB wrappers
eef10334by Lee *!* Clagett+155−6839 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix docker conditional

This commit fixes a simple syntax typo in a GitHub Actions workflow file. The condition that decides whether to add release tags had an extra closing brace, which would cause the workflow to fail parsing rather than run incorrectly. There …

cbf6f328by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Latest master

This commit only updates the 'external/monero' git submodule pointer from one commit hash to another. No actual source code changes are shown in this repository's diff. The title and message are generic ('Latest master') and give no indica…

248e9148by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 58 · Thin
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix mempool webhook read during subaddress scanning (#283)

This commit fixes a bug in the Monero Light Wallet Server (LWS) where webhook notifications for mempool transactions could fail or behave incorrectly when scanning subaddresses. The change passes an existing database reader into the output…

Fixes a read-transaction lifecycle issue in webhook lookup during mempool scanningAdds regression test covering mempool publication + webhook deliveryCallback signature change propagates an existing storage_reader to avoid nested/duplicate reads
89e90f58by Lee *!* Clagett+354−136 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 53 · Thin
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Add/update newest GPG signing key (#282)

This commit simply adds a new GPG public key file to the repository. A GPG public key is used to verify that future releases or commits were genuinely signed by the project maintainer. There is no code change, no vulnerability, and no secu…

5b64b31eby Lee *!* Clagett+22−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 45 · Thin
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Another attempt at fixing external/monero pin

This commit is a routine build/maintenance change that adjusts which version of the external Monero dependency is pinned. There is no indication of any security fix, vulnerability, or user-facing behavior change. It is essentially a housek…

1e48ef2bby Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 4 AI analysisMessage 45 · Thin
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix external/master pin back to master

This commit appears to change which version of an external Monero component the project points to (a so-called 'git submodule pin' or dependency reference). The title says it fixes the pin for 'external/master' back to the 'master' branch.…

d7f8ef46by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 58 · Thin
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix `MDB_BAD_RSLOT` in `subaddress_reader::update_reader()` causing permanently missed subaddress outputs (#278)

This commit fixes a database-handling bug in Monero Light Wallet Server (LWS). The bug caused the server to permanently miss some subaddress outputs because a read transaction was not closed before a new one was opened, triggering an LMDB …

Fixes LMDB transaction-slot error (MDB_BAD_RSLOT)Prevents permanently missed subaddress outputsChanges test expectations to reflect recovered output
38b336e2by Evgeny+8−33 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 63 · Adequate
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Fix integer overflow check in subaddress handling (#264)

This commit fixes a math mistake when checking whether a user requested too many Monero subaddresses. The original code divided two numbers and compared the result to a maximum, which is the wrong way to detect overflow and could allow the…

Integer overflow check corrected from an inverted/incorrect comparison to a canonical safe division pre-checkOccurs in subaddress limit enforcement, which is a security boundary against excessive address derivationSame bug pattern present in two independent locations (storage and REST server)
33c56770by Lee *!* Clagett+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Bump branch to 1.1-alpha

This commit simply changes a version string from '1.0-alpha' to '1.1-alpha' in a single source file. There is no functional code change, no bug fix, and no security relevance visible in the diff or commit message.

fb599e8aby Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Bump mkdocs to regenerate

This commit changes one character in the documentation configuration file (mkdocs.yml), adding a trailing slash to the site description. It does not touch any program code, cryptographic logic, network handling, or user data. There is no s…

322f5827by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Another publish attempt

This commit is a routine documentation-site fix. It changes how the MkDocs documentation builder is invoked in a GitHub Actions workflow (from `python3 mkdocs build` to `python3 -m mkdocs build`) and fixes a typo in the site description. T…

d86d25a7by Lee *!* Clagett+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

tweaking docs

This commit makes a trivial wording change to the project's documentation configuration file, adding a slash to the site description. There is no security relevance.

1647bdb2by Lee *!* Clagett+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 73 · Adequate
LWS Monero LWSMonero LWS Indexing infrastructureMoneroPrivacy protocols

Add mempool support to /get_address_txs and /feed (#251)

This commit adds mempool (pending transaction) support to Monero Light Wallet Server. It lets users see unconfirmed transactions through the /get_address_txs REST endpoint and the live /feed websocket. The change also refactors how the ser…

Large feature commit (+1906/-634) touching REST, WebSocket feed, scanner, and new mempool componentRefactored transaction ownership scanning into shared ownership_test helper; reduces duplicated crypto/derivation logicMempool transactions are parsed and validated before being added to the local cache in /submit_raw_tx
a7aea46eby Lee *!* Clagett+1906−63432 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedAdd from_height to /import_wallet_request (#194)by Lee *!* Clagett · 151d3092 · Nov 5, 2025 · 4 filesMessage 53 · ThinLow 28Details
Commit message · Lee *!* Clagett

Add from_height to /import_wallet_request (#194)

53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 28/100

This commit adds a new optional 'from_height' field to the /import_wallet_request endpoint in the Monero Light Wallet Server. Previously, import requests always started scanning from block 0. Now users can request a later starting block height. The change appears to be a feature addition rather than a security fix, though it touches authentication-related code paths.

Lower-priorityAdd regtest option (#193)by everoddandeven · 01374ec6 · Nov 5, 2025 · 7 filesMessage 58 · ThinTriage 0Details
Commit message · everoddandeven

Add regtest option (#193)

Disable checkpoints check on storage::sync_chain when regtest mode is enabled

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Lower-priorityDrop macos-13 and add macos-15 (#192)by Lee *!* Clagett · d76a19f8 · Nov 3, 2025 · 1 fileMessage 53 · ThinTriage 0Details
Commit message · Lee *!* Clagett

Drop macos-13 and add macos-15 (#192)

53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityUpdate limits for get_random_outs (#190)by Lee *!* Clagett · 73fb2f77 · Oct 29, 2025 · 1 fileMessage 53 · ThinTriage 0Details
Commit message · Lee *!* Clagett

Update limits for get_random_outs (#190)

53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityUpdate Dockerfile to use newest unboundby Lee *!* Clagett · 653fbfd6 · Oct 22, 2025 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Lee *!* Clagett

Update Dockerfile to use newest unbound

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityUpdate README and set Dockerfile to perform Release buildsby Lee *!* Clagett · c06dd121 · Oct 17, 2025 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Lee *!* Clagett

Update README and set Dockerfile to perform Release builds

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityAdd GH workflow for docker build and push (#186)by Lee *!* Clagett · 3d12cc1c · Oct 17, 2025 · 4 filesMessage 53 · ThinTriage 0Details
Commit message · Lee *!* Clagett

Add GH workflow for docker build and push (#186)

53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityReconnect RMQ on publish failure (#181)by Lee *!* Clagett · 89555475 · Oct 15, 2025 · 1 fileMessage 53 · ThinTriage 0Details
Commit message · Lee *!* Clagett

Reconnect RMQ on publish failure (#181)

53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body