CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17518Commits captured
17128AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17128 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

clusterlin: avoid heap allocations in GetLinearization

This is a routine performance optimization in Bitcoin Core's transaction-cluster linearization code. It replaces dynamically-allocated vectors with fixed-size stack arrays to avoid repeated heap memory allocations. There is no security-rel…

e6ca9962by Pieter Wuille+26−201 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

clusterlin: reserve the suboptimal-chunk queue up front

This is a routine performance improvement, not a security fix. It pre-allocates memory for an internal queue so the program doesn't waste time repeatedly resizing it while building a data structure. There is no user-facing or security-rele…

4b91ad14by Pieter Wuille+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

clusterlin: avoid recomputing intersections in MergeChunks

This is a small internal performance improvement in Bitcoin Core's transaction clustering code. It avoids doing the same bit-set intersection twice by saving the result of the first pass. There is no security-relevant change: no new behavi…

efb4eae3by Pieter Wuille+10−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/ethereum): simplify `confirm_data_and_summary()`

This is a small internal code cleanup in Trezor's Ethereum transaction signing. It replaces two separate return values with a single tuple, because they are always either both present or both absent. There is no user-visible behavior chang…

814203e1by Roman Zeyde+23−292 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

CODEOWNERS: remove @devrandom

This commit simply removes a GitHub user from the CODEOWNERS file for one file. CODEOWNERS controls who is automatically asked to review changes. The user was removed because they no longer have write access, which is required for CODEOWNE…

12790264by daywalker90+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: add release notes for v0.21.2

This commit only adds a line to the release notes document for version 0.21.2. It mentions that a bug was fixed where a feature called the 'RBF closer' could be used with incompatible auxiliary channels. The commit itself does not change a…

0501731cby Jared Tobin+4−01 file
No security note in commit
Open full analysis →Source commit ↗
High 74 AI analysisMessage 76 · Adequate
LL Lightning LabsLND BitcoinLightning Network

peer: never use RBF coop close for aux channels

This commit fixes a bug in LND where a new cooperative channel-closing mechanism (RBF coop close) was being used for special 'aux' channels that carry Taproot Assets. Those aux channels need extra steps to safely move the assets out, but t…

Loss-of-funds / asset-destruction bug for aux (taproot asset overlay) channelsChannel-stuck / denial-of-service side effect (waiting-close state)Feature-bit selection bypassed per-channel safety checks
ceff3cebby Jared Tobin+145−303 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): Features.language_version_matches true even if build_version differs

This commit fixes a minor logic bug in the Trezor hardware wallet firmware. Previously, the device reported that its stored language translation data matched the firmware version only when the full four-part version numbers matched exactly…

Strict version equality relaxed to prefix comparisonNo cryptographic or signature verification changesNo privilege boundary or authorization change
f1f9a372by Martin Milata+17−123 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): unify autolock duration formatting

This commit fixes a minor user-interface inconsistency in how the Trezor device displays auto-lock delays longer than a day. Previously, the confirmation dialog showed "48 hours" while the settings menu showed "2 days" for the same delay. …

No memory safety, cryptographic, or authorization changesNo input validation or parsing logic changesOnly string formatting and translation key renaming
28197f4dby Jakub Janků+105−13817 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Refactor Encoder and ExactSizeIterator Option impls

This commit is a straightforward code cleanup in the Rust Bitcoin library. It replaces a few verbose 'match' statements with shorter, more idiomatic Option helper methods. There is no functional change and no security relevance.

f723b10aby Abeeujah+3−161 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: flatten error constructors

This commit is a pure code-style refactor. It rewrites how error values are built so each wrapping step is on its own line instead of being nested inside a single expression. The actual error values produced and the program's behavior are …

0d4a9ddcby Abeeujah+26−112 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(clear_signing): add Trezor Test descriptor and clear-signing tests

This commit only adds two new import names (DateFormatter and RawFormatter) to an existing Python file in the Ethereum clear-signing module. It is a test-related change with no functional code modifications, no bug fixes, and no security-s…

dfe90892by PrisionMike+2−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →