CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17490Commits captured
17117AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17117 analyses
Highest risk·RSS
Low 26 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Change Protocol class field order

This is a small defensive code change in Bitcoin Core's inter-process communication (IPC) code. It reorders two class member variables so that the event loop is destroyed before the background thread that runs it. The commit message says t…

Object lifetime / destruction order fix in multithreaded IPC codePotential use-after-free or race condition during shutdown mitigated by orderingCommit message describes change as preventive, not a fix for a known vulnerability
00287b9aby Ryan Ofsky+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: use native path separators in test

This is a small test-only cleanup that changes hardcoded Unix-style forward slashes in a test file to use the operating system's native path separator. It does not change any production code or fix a security bug.

7c86d483by Ryan Ofsky+6−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: fix include order

This is a purely cosmetic code cleanup that reorders #include lines in a single source file. It moves two standard C++ library headers (<utility> and <vector>) to sit with the other standard headers, separate from POSIX system headers. The…

dbcc192dby Ryan Ofsky+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc: Avoid 'unistd.h' error with MSVC

This commit fixes a Windows build problem. The code included a Unix-only header file ('unistd.h') unconditionally, which caused Microsoft Visual C++ (MSVC) compilation to fail because that header does not exist on Windows. The fix wraps th…

34497971by Ryan Ofsky+4−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Add ProcessId type alias and use it

This is a straightforward code cleanup that renames the type used for process IDs from plain 'int' to a new 'ProcessId' alias. It makes the code compatible with a future library update that will support Windows, but does not change any act…

2ee9b69cby Ryan Ofsky+27−54 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Add SocketId type alias and use it

This commit is a straightforward code cleanup: it replaces the plain 'int' type with a new 'SocketId' type alias when referring to socket identifiers throughout Bitcoin Core's inter-process communication (IPC) code. The change is described…

3859805fby Ryan Ofsky+42−407 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Add Stream type alias and use it

This is a straightforward internal code cleanup in Bitcoin Core's inter-process communication (IPC) layer. It replaces direct use of raw socket identifiers with a new 'Stream' type alias so the code can work with an upcoming version of a s…

e9f19815by Ryan Ofsky+57−325 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 78 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Warn before truncated value displays

This commit adds a warning screen to the BitBox02 hardware wallet whenever a long message or value is about to be shown in a truncated form. Previously, the device could silently cut off the end of very long transaction details, message da…

UI truncation warning added before oversized confirmation bodiesCentralized body-size limit to keep Rust and C UI limits in syncReplaced duplicated warning logic with shared confirm_value helper
5b3aee6fby benma's agent+266−4710 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

fuzz: Fix stale script

This commit updates version numbers and commit hashes inside a fuzz-testing shell script that generates GitHub Actions workflow files. It is a routine maintenance change to keep the generated CI configuration in sync with the project's cur…

cdd2ecd2by Tobin C. Harding+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

io: Bump version to 0.6.0

This commit is purely a release housekeeping change. It bumps the version number of the `bitcoin-io` crate from 0.5.0 to 0.6.0, updates the changelog, and refreshes the lock files so other crates in the project depend on the new version. T…

545aeeb2by Tobin C. Harding+17−75 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Reject invalid Zcash display totals

This update fixes how a Keystone hardware wallet calculates the on-screen totals for Zcash transactions. Previously, the firmware used plain addition that could silently overflow or accept impossible totals (for example, showing more chang…

Integer overflow in transaction value display logicUnchecked arithmetic could produce misleading transfer/fee amounts shown to the userImbalance between inputs, outputs, and change not previously rejected
28607f56by Adam Tucker+204−1073 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(build): forward `REPRODUCIBLE_XTASK_BUILD_OPTS` into reproducible build script

This is a small build-script fix. It makes an environment variable named REPRODUCIBLE_XTASK_BUILD_OPTS actually get passed into the Docker container during reproducible firmware builds, and adds a help message about it. On its own, the cha…

No direct security signal in the diff: no bounds checks, crypto changes, privilege changes, or input sanitization.The change exposes an additional environment variable into the build container, which could in principle affect build reproducibility or build flags if the variable contains untrusted content.No CVE, advisory, or vendor security statement is present in the supplied materials.
4e97e159by M1nd3r+2−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →