Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

24Projects watched
17557Commits captured
17148AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17148 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 38 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

depends: capnp 1.5.0

This commit simply updates the version of a build dependency (Cap'n Proto, a data serialization library used during compilation) from 1.4.0 to 1.5.0 in Bitcoin Core's dependency system. It changes only a version number and the correspondin…

a2e4cd7aby fanquake+2−21 file
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

field: serialize elements by word

This commit is a clean-up rewrite of how internal numeric values are converted into 32-byte output inside the secp256k1 cryptography library. It replaces many byte-by-byte shift-and-mask operations with a smaller number of whole-word write…

e217ead5by Lőrinc+12−642 files
No security note in commit
Informational 15 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix build

This commit fixes a YAML syntax error in two test docker-compose files. Trailing commas after environment variable values were removed in one file, and a missing environment variable was added in the other. This is purely a build/test conf…

660aabddby Nicolas Dorier+3−22 files
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace use of as_str().len() with .len()

This is a trivial code cleanup inside a test file. It replaces a slightly longer way of getting a string's length with a shorter, equivalent way. There is no security relevance.

3952e574by Mitchell Bagot+1−11 file
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add len and is_empty to Base58CkString

This commit adds two simple helper methods, len() and is_empty(), to a Rust type that holds a base58check-encoded string. It is a routine convenience/API improvement with no security relevance visible in the code or commit message.

dcb7558bby Mitchell Bagot+6−01 file
No security note in commit
Informational 15 AI analysisMessage 38 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix flaky test

This commit only changes test code. It fixes a flaky automated UI test by replacing two generic page-load waits with a helper that waits for a specific logged-in URL, and corrects the logic for deciding whether Playwright browser tests run…

7be7ff18by Nicolas Dorier+6−42 files
No security note in commit
Informational 15 AI analysisMessage 0 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix build

This is a one-line change in a test file that fixes a C# compiler/build error by switching from object-initializer syntax to a named parameter. It has no effect on the actual BTCPay Server application or its security.

9d7e1f3aby Nicolas Dorier+1−11 file
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

bench: replace CreateMockableWalletDatabase with MakeInMemoryWalletDatabase

This commit is a small internal cleanup in Bitcoin Core's benchmark code. It swaps a test-only mock wallet database helper for a real in-memory SQLite database helper in five benchmark files. There is no change to production wallet code, n…

7508ac31by Pablo Martin+12−85 files
No security note in commit
Informational 12 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Remove useless code

This commit removes a single line of code that treated the 'comment' field as a special verbose metadata field in invoice reports. The change appears to be a cleanup: the comment field is already exported separately as 'InvoiceComment', so…

61b27b76by Nicolas Dorier+1−31 file
No security note in commit
Informational 21 AI analysisMessage 86 · Strong
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Add editable invoice comments (#7444)

This commit adds a new editable comment field to BTCPay Server invoices. Store staff can add private notes to invoices through the web interface or API, and these comments appear in invoice reports. The change is a normal feature addition,…

New user-supplied string persisted to database and rendered in admin views/API responsesRaw SQL update into jsonb Blob2 column bypasses EF change trackingUpdateInvoiceMetadata signature changed; deprecated overload ignores storeId, potentially widening access if callers relied on store-scoped enforcement
4eaae5bdby dstrukt+189−2217 files
No security note in commit
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

internals: Bump version to 0.6.0

This commit is a routine version bump for the internal 'bitcoin-internals' crate from 0.5.0 to 0.6.0. It updates version numbers across package manifests and lock files, and adds a changelog describing API cleanups and small improvements. …

aed7a9ceby Tobin C. Harding+73−5616 files
No security note in commit
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this