CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17542Commits captured
17134AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17134 analyses
Highest risk·RSS
Low 27 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

perf(zcash): reuse checked batch signability

This commit is a performance improvement for Zcash batch signing on the Keystone 3 hardware wallet. It avoids re-checking the same transaction data twice by caching a 'signability decision' from the review step and reusing it during signin…

Adds SHA-256 digest binding of cached signability decision to normalized PCZT bytesAdds seed fingerprint and account index binding for cached batch signability decisionsReuses previously validated signable shielded action list at signing time instead of recomputing it
2ea86362by Adam Tucker+230−424 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix(zcash): skip finalized dummy spends during signing

This commit fixes a bug in the Keystone hardware wallet's Zcash signing code. When signing a batch of Zcash transactions that include 'dummy' placeholder spends (zero-value decoy actions used for privacy), the signer could get stuck or fai…

Zcash privacy-spend signing bypass for finalized dummy actionsBatch-transport redaction state reproduced in regression testPotential signing failure / denial-of-service for Zcash PCZT transactions with dummy spends
9792998aby Adam Tucker+81−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Use typed batch firmware version encoding

This commit updates the firmware's Zcash batch signing result to use a new typed encoding for the firmware version field. It is a routine dependency bump and code adjustment to match a changed SDK API. There is no direct evidence in the co…

Dependency update to newer SDK revisionChange in firmware version encoding type for Zcash batch signature resultsNo explicit security fix described in commit message or diff
e4c1713cby Adam Tucker+8−53 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Clarify firmware version wire encoding

This commit only changes a code comment to make it clearer where a particular 3-byte version format is used. No actual code behavior was changed, so it cannot introduce or fix a security issue on its own.

c531d791by Adam Tucker+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Clarify firmware version source

This commit only updates comments and documentation to make clear which firmware version number is sent over the wire for Zcash signing. It does not change any code behavior, so it is not a security fix and does not introduce a vulnerabili…

e9b2548cby Adam Tucker+11−52 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

rpcserver: fix stats undercount in GetNetworkInfo

This commit fixes a simple coding mistake in LND's GetNetworkInfo RPC. When building network statistics, if the code encountered a channel it had already counted, it accidentally stopped processing that node's remaining channels instead of…

No security framing in commit message or release notesBug is a logic/correctness error causing under-reported statisticsNo input validation, authorization, memory safety, or cryptographic issues evident
9ccd3056by elnosh+9−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Report firmware version in Zcash batch results

This commit adds the firmware version number to Zcash batch signing responses. It is a feature/documentation change, not a security fix or vulnerability. The version was already included in single-transaction responses; now it is also incl…

38219fdeby Adam Tucker+29−186 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: emit a single dataChanged when updating blockchain height

This change is a performance cleanup in Electrum's mobile/QML user interface. When the wallet learns that the Bitcoin blockchain has grown taller, it now refreshes the transaction list with a single 'everything changed' signal instead of s…

No security-relevant logic changePerformance/efficiency optimization onlyNo input validation, parsing, cryptography, or network changes
fbe9e2d8by f321x+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 85 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

qml: don't compute notification balance delta for large tx batches

This commit is a performance fix, not a security patch. It stops the Electrum mobile/QML wallet from calculating the total balance change when more than 20 new transactions arrive at once, because that calculation could freeze the user int…

No security-relevant signal present in the diff or commit messagePerformance/DoS mitigation against accidental UI freezing from large transaction batches
7b4759c5by f321x+5−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: change event callback logs to debug

This commit simply changes two logging messages from 'info' level to 'debug' level in the mobile/QML wallet interface. It reduces routine log output when many transactions occur. There is no security-relevant change.

a6cc4e08by f321x+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: don't force-build address model from tx event handlers

This is a performance and responsiveness fix for the Electrum mobile/QML wallet. It stops the app from doing heavy work (building the address coin list) every time a new transaction arrives, which was causing the user interface to freeze. …

35fc4a13by f321x+4−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: skip per-tx balance updates during sync

This commit is a performance optimization for Electrum's mobile/QML user interface. It prevents the wallet balance from being recalculated and redrawn on every incoming transaction during synchronization, because the balance isn't shown du…

54cccd4fby f321x+4−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →