CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17542Commits captured
17134AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17134 analyses
Highest risk·RSS
Informational 17 AI analysisMessage 80 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor(bip32): Xpub child tweak api

This commit is a straightforward API refactor in the BIP-32 (Bitcoin key derivation) code. It replaces a function that returned a raw secret key and chain code with one that returns a new structured type called XpubChildTweak. The actual c…

No security-relevant behavioral change observedAPI rename and return-type encapsulation onlyNo new validation, bounds checking, or constant-time guarantees added
37191717by Trevor Arjeski+21−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 85 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor(bip32): rename Xpub and Xpriv derivation methods

This is a routine code cleanup in a Bitcoin library. It renames key-derivation methods on extended public and private keys (Xpub/Xpriv) to clearer names and removes old aliases. There is no security bug being fixed and no new vulnerability…

No security-relevant logic changePure API renaming/refactoringDeprecated method removal may break downstream callers at compile time
f8f053fdby Trevor Arjeski+61−852 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

fix debug step for windows

This commit only adjusts a temporary debugging step in the project's automated build workflow. It makes the debug script more tolerant of Windows paths and failures, and prints extra diagnostic information. There is no change to the wallet…

No security-relevant code changesCI workflow diagnostic step onlyNo dependency version changes
fa9194a0by Craig Raw+27−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add debug step to determine cause of failing verification

This commit adds temporary debug logging to a GitHub Actions build workflow. It prints file hashes and downloads a public Maven module to help diagnose why Gradle dependency verification is failing. There is no code change to the Sparrow W…

73897fc5by Craig Raw+13−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

sha pin all github actions for package workflow

This commit changes the project's automated build workflow to lock down the exact versions of external GitHub Actions it uses by specifying their cryptographic SHA fingerprints instead of version tags. This is a defensive hardening measure…

Supply-chain hardening via SHA pinning of third-party GitHub ActionsProtection against tag-retargeting and compromised action updatesApplies to actions handling source checkout, Java setup, macOS code signing/notarization, and artifact upload
72c1d822by Craig Raw+5−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

cln-grpc: vendor protoc as a build-dependency

This change swaps how the project gets its Protocol Buffers compiler (protoc) for one Rust component. Instead of relying on whatever version the operating system or CI happens to install, it bundles a specific protoc version as a build-tim…

Build dependency pinning to reduce supply-chain/version-drift riskRemoval of curl/wget-based protoc downloads from CI and DockerfilesNo runtime code or protocol logic changes
608f6952by daywalker90+74−7513 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

initial generation of gradle dependency verification metadata

This commit adds Gradle's dependency verification files. These files list the public keys and expected checksums for the libraries the project downloads during its build. It is a standard supply-chain hardening step, not a code change that…

a1301660by craigraw+4618−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 60 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

create gradle dependency verification update workflow

This commit adds a GitHub Actions workflow that automatically updates the project's Gradle dependency verification files. These files are a security control that helps ensure downloaded build dependencies have not been tampered with. The c…

Adds dependency verification metadata generation workflowUses pinned GitHub Action commit SHAs for supply-chain integrityRestricts default workflow permissions to contents: read
c7798d92by nzb-tuxxx+296−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: bump project versions

This commit only updates version numbers and translation metadata. It changes no program logic, fixes no bugs, and introduces no security-relevant behavior. There is nothing here that could be exploited or that changes how the device prote…

7884a5a6by PrisionMike+13−1311 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

lntransport: wrap connection errors in send_bytes_and_drain

This commit fixes a minor error-handling bug in Electrum's Lightning network code. When the program tried to send data over a peer connection that had already dropped, a low-level 'Connection lost' error was escaping instead of being conve…

Defensive exception normalization in network I/O pathNo untrusted input parsing or memory-unsafe operation introducedNo authentication, authorization, or cryptographic change
9ff2a566by SomberNight+4−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

android build: fix prev: chown fresh_clone base dir before git clone

This is a build script fix for Electrum's Android build process. It changes how a temporary directory is cleaned up before a fresh git clone. The change adds a `chown` command so the build user can remove files owned by root, preventing bu…

No security-relevant keywords in commit title or messageNo CVE, advisory, or security attribution presentChange is in build tooling, not runtime code
7785865cby SomberNight+5−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc # build: Fix fuzz target CMakeLists.txt for external libmultiprocess

This is a one-line build-system fix for a Bitcoin Core fuzz-testing target. It changes a CMake target name so the correct header paths are found when libmultiprocess is built externally instead of bundled. It does not change runtime behavi…

No security-relevant code change: build configuration onlyNo functional, consensus, or network changesNo memory safety, cryptography, or permission changes
db35b923by Ryan Ofsky+1−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →