CashuPayServer v0.5.6-alpha is out, and it's the most thoroughly reviewed release yet.
Three independent security audits went through CashuPayServer and its Cashu wallet library line by line. This release fixes what they found. If you take bitcoin payments with CashuPayServer, please upgrade, although no bug was remotely exploitable or critical.
What's new:
- Payment requests work with any standard Cashu wallet. Show a QR code, the customer pays, and the page turns to "Paid ✓" the moment the money arrives. Newer wallets also get the compact creqB format, a smaller QR code that's easier to scan.
- Payments and withdrawals are much harder to break in extreme conditions.
- Safer data out of the box. If your wallet database could be downloaded from the web, the dashboard tells you, and a new install can move its data to a safe place with one click.
Upgrading takes a couple of minutes, and there's nothing to configure:
- Standalone: upload the new files over the old ones, keeping your data folder.
- WordPress: upload the plugin and choose "Replace current with uploaded".
The database updates itself on your first visit.
Cheap PHP hosting, no node to run, bitcoin payments in your shop.
About the audits: We have always run Ai audits with all the models available. This round brings DeepSeek 4.1 Flash 1017, Opus 5.5 and MiniMax M3.1 (also known as Space Bunny). All of them found real bugs previous audits/models did not find. And we have run the heavyweights on CashuPayServer before. MiniMax M3.1 was the only one that found a higher severity bug, which all previous scans missed. Since it is free on OpenCode for a few days, run your security-critical code through it.
👉 Download: https://github.com/jooray/cashupayserver/releases/tag/v0.5.6-alpha
Cashu Pay Server
npub18s…nalja
2026-10-19 19:45:00 GMT
Author Public Key
npub18scydh6yusrkhe67f8uz9mnxxt5znae59ctvhxxpzefkf7xwnx4q0naljaPublished at
2026-10-19 19:45:00 GMTEvent JSON
{
"id": "f3b745bfe8733696db31ead4f471419d6421a0ba788522c17f321d17e2fbac38",
"pubkey": "3c3046df44e4076be75e49f822ee6632e829f7342e16cb98c1165364f8ce99aa",
"created_at": 1792439100,
"kind": 1,
"tags": [],
"content": "CashuPayServer v0.5.6-alpha is out, and it's the most thoroughly reviewed release yet.\n\nThree independent security audits went through CashuPayServer and its Cashu wallet library line by line. This release fixes what they found. If you take bitcoin payments with CashuPayServer, please upgrade, although no bug was remotely exploitable or critical.\n\nWhat's new:\n\n- Payment requests work with any standard Cashu wallet. Show a QR code, the customer pays, and the page turns to \"Paid ✓\" the moment the money arrives. Newer wallets also get the compact creqB format, a smaller QR code that's easier to scan.\n- Payments and withdrawals are much harder to break in extreme conditions.\n- Safer data out of the box. If your wallet database could be downloaded from the web, the dashboard tells you, and a new install can move its data to a safe place with one click.\n\nUpgrading takes a couple of minutes, and there's nothing to configure:\n- Standalone: upload the new files over the old ones, keeping your data folder.\n- WordPress: upload the plugin and choose \"Replace current with uploaded\".\n\nThe database updates itself on your first visit.\n\nCheap PHP hosting, no node to run, bitcoin payments in your shop.\n\nAbout the audits: We have always run Ai audits with all the models available. This round brings DeepSeek 4.1 Flash 1017, Opus 5.5 and MiniMax M3.1 (also known as Space Bunny). All of them found real bugs previous audits/models did not find. And we have run the heavyweights on CashuPayServer before. MiniMax M3.1 was the only one that found a higher severity bug, which all previous scans missed. Since it is free on OpenCode for a few days, run your security-critical code through it.\n\n👉 Download: https://github.com/jooray/cashupayserver/releases/tag/v0.5.6-alpha",
"sig": "9fc3efc7e83018263a6e6baa771638d0a7adba2512b0216691b12ade9d699024440a8f2935eada13740da4f457b4ab3b761acfe9c258129095d7a98eff2cc66d"
}