CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17529Commits captured
17131AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17131 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 65 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Refactor Encoder and ExactSizeIterator Option impls

This commit is a straightforward code cleanup in the Rust Bitcoin library. It replaces a few verbose 'match' statements with shorter, more idiomatic Option helper methods. There is no functional change and no security relevance.

f723b10aby Abeeujah+3−161 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: flatten error constructors

This commit is a pure code-style refactor. It rewrites how error values are built so each wrapping step is on its own line instead of being nested inside a single expression. The actual error values produced and the program's behavior are …

0d4a9ddcby Abeeujah+26−112 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(clear_signing): add Trezor Test descriptor and clear-signing tests

This commit only adds two new import names (DateFormatter and RawFormatter) to an existing Python file in the Ethereum clear-signing module. It is a test-related change with no functional code modifications, no bug fixes, and no security-s…

dfe90892by PrisionMike+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): ERC-7730 constant (const_value) display fields

This commit adds a new way for Ethereum transaction definitions to include fixed text labels (called 'constant values') that are shown to the user during signing. It does not change how transaction data is parsed or signed, but it expands …

New untrusted input surface: `const_value` string in ERC-7730 display-format definitions is rendered to the user without length or content validation visible in the diff.Display-only data path bypasses calldata parsing, so a malicious or compromised host-side definition could show arbitrary constant text alongside real transaction fields.No input sanitization, escaping, or length limits are added for `const_value` in the changed code.
9e593447by PrisionMike+156−487 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: Deduplicate end() error path in decoders

This commit is a straightforward internal code cleanup. It removes duplicated error-handling code in three decoder 'end' methods and rewrites the logic using pattern matching and early returns. There is no change to what errors are produce…

b30de4d4by Abeeujah+23−392 files
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

ecdh_hsmd: ensure HSM fd is blocking on setup

This commit fixes a bug where a special internal communication channel (file descriptor) used by Core Lightning could accidentally be left in non-blocking mode on macOS under heavy load. When that happened, a part of the program expecting …

Crash/DoS condition in connectd/channeld due to unexpected EAGAIN on synchronous HSM readInherited O_NONBLOCK on SCM_RIGHTS-passed socketpair fd on macOSDefensive hardening: explicit blocking-mode enforcement on setup
f40be192by Níckolas Goline+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 43 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Rename <vc:breadcrumb> (#7456)

This commit is a routine UI refactor: it renames the internal ASP.NET Core view component from <vc:breadcrumb> to <vc:title-header>, updates CSS class names, and standardizes how page titles are set across many Razor views. There is no sec…

7d206d93by Nicolas Dorier+189−199106 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tools): validate date format in changelogs

This commit is a routine tooling change. It adds a date-format check to the script that manages changelog files and removes empty subsections from generated changelogs. There is no security relevance: it does not touch firmware, cryptograp…

f48e3adeby obrusvit+47−151 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: unify date format in changelogs

This commit only changes the way dates are written in changelog files, switching from a numeric format like '2026-06-17' to a written format like '17th June 2026'. It does not modify any program code, build scripts, or security-related beh…

0705c17cby obrusvit+48−488 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: trim model changelogs to what is relevant

This commit is a routine housekeeping change. It trims and cleans up the text in several product changelogs, removing old release notes and empty section headings that were not relevant to each specific Trezor hardware model. No program co…

47251498by obrusvit+8−28687 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

depends: Update Qt to 6.8.4

This commit updates the Qt graphical toolkit used by Bitcoin Core from version 6.8.3 to 6.8.4 in the project's dependency build system. It also refreshes Bitcoin-specific patches, removes one now-unneeded build patch, and disables a new RI…

Dependency version bump to Qt 6.8.4Removal of local build patch now upstreamed in Qt 6.8.4Bundled libpng RISC-V vector extension disabled for riscv64 cross-compile
226e6388by Hennadii Stepanov+21−538 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

qml: update ConfirmTxDialog onValidChanged

This is a small user-interface fix for the Electrum mobile/QML app. When sweeping private keys, the confirmation dialog that shows how much money will be moved initially displayed an amount of 0 because it did not refresh after the transac…

bd776e24by f321x+3−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →