CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17513Commits captured
17125AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17125 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Add ProcessId type alias and use it

This is a straightforward code cleanup that renames the type used for process IDs from plain 'int' to a new 'ProcessId' alias. It makes the code compatible with a future library update that will support Windows, but does not change any act…

2ee9b69cby Ryan Ofsky+27−54 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Add SocketId type alias and use it

This commit is a straightforward code cleanup: it replaces the plain 'int' type with a new 'SocketId' type alias when referring to socket identifiers throughout Bitcoin Core's inter-process communication (IPC) code. The change is described…

3859805fby Ryan Ofsky+42−407 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Add Stream type alias and use it

This is a straightforward internal code cleanup in Bitcoin Core's inter-process communication (IPC) layer. It replaces direct use of raw socket identifiers with a new 'Stream' type alias so the code can work with an upcoming version of a s…

e9f19815by Ryan Ofsky+57−325 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 78 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Warn before truncated value displays

This commit adds a warning screen to the BitBox02 hardware wallet whenever a long message or value is about to be shown in a truncated form. Previously, the device could silently cut off the end of very long transaction details, message da…

UI truncation warning added before oversized confirmation bodiesCentralized body-size limit to keep Rust and C UI limits in syncReplaced duplicated warning logic with shared confirm_value helper
5b3aee6fby benma's agent+266−4710 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

fuzz: Fix stale script

This commit updates version numbers and commit hashes inside a fuzz-testing shell script that generates GitHub Actions workflow files. It is a routine maintenance change to keep the generated CI configuration in sync with the project's cur…

cdd2ecd2by Tobin C. Harding+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

io: Bump version to 0.6.0

This commit is purely a release housekeeping change. It bumps the version number of the `bitcoin-io` crate from 0.5.0 to 0.6.0, updates the changelog, and refreshes the lock files so other crates in the project depend on the new version. T…

545aeeb2by Tobin C. Harding+17−75 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Reject invalid Zcash display totals

This update fixes how a Keystone hardware wallet calculates the on-screen totals for Zcash transactions. Previously, the firmware used plain addition that could silently overflow or accept impossible totals (for example, showing more chang…

Integer overflow in transaction value display logicUnchecked arithmetic could produce misleading transfer/fee amounts shown to the userImbalance between inputs, outputs, and change not previously rejected
28607f56by Adam Tucker+204−1073 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(build): forward `REPRODUCIBLE_XTASK_BUILD_OPTS` into reproducible build script

This is a small build-script fix. It makes an environment variable named REPRODUCIBLE_XTASK_BUILD_OPTS actually get passed into the Docker container during reproducible firmware builds, and adds a help message about it. On its own, the cha…

No direct security signal in the diff: no bounds checks, crypto changes, privilege changes, or input sanitization.The change exposes an additional environment variable into the build container, which could in principle affect build reproducibility or build flags if the variable contains untrusted content.No CVE, advisory, or vendor security statement is present in the supplied materials.
4e97e159by M1nd3r+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: Drop unnecessary mutexes

This commit removes unnecessary mutexes (simple locking mechanisms) from two internal Bitcoin Core fuzz test files. Fuzz tests are automated testing tools, not part of the live Bitcoin network software. The change is a code cleanup: the de…

240d5f74by marcofleon+5−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

clusterlin: avoid heap allocations in GetLinearization

This is a routine performance optimization in Bitcoin Core's transaction-cluster linearization code. It replaces dynamically-allocated vectors with fixed-size stack arrays to avoid repeated heap memory allocations. There is no security-rel…

e6ca9962by Pieter Wuille+26−201 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

clusterlin: reserve the suboptimal-chunk queue up front

This is a routine performance improvement, not a security fix. It pre-allocates memory for an internal queue so the program doesn't waste time repeatedly resizing it while building a data structure. There is no user-facing or security-rele…

4b91ad14by Pieter Wuille+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

clusterlin: avoid recomputing intersections in MergeChunks

This is a small internal performance improvement in Bitcoin Core's transaction clustering code. It avoids doing the same bit-set intersection twice by saving the result of the first pass. There is no security-relevant change: no new behavi…

efb4eae3by Pieter Wuille+10−51 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →