CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17562Commits captured
17152AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17152 analyses
Highest risk·RSS
Low 29 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): check and parse batch PCZTs in a single pass

This commit refactors how Keystone's Zcash firmware checks and parses batches of partially-created shielded transactions (PCZTs). It merges what used to be separate validation and display steps into a single pass, adds a new public functio…

New validation+parse single-pass path for batch PCZTsRecomputes shielded bundle value balance and compares against declared value_sumAdds account-index boundary test (account 1 returns PcztNoMyInputs)
c55a8572by Adam Tucker+324−23 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

ci(zcash): run rust_c Zcash tests for relevant changes

This commit only adds a new GitHub Actions CI workflow that runs automated tests for Zcash-related Rust code when relevant files change. It does not modify any firmware code, cryptographic logic, or user-facing behavior. There is no securi…

25c20357by Adam Tucker+26−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

perf(zcash): hoist the shielded sighash out of the per-action loop

This commit is a small performance and code-clarity improvement for Zcash shielded transaction signing in a Keystone hardware wallet firmware component. It moves a repeated transaction-hash calculation out of a per-action loop so it is com…

Eliminates repeated recomputation of shielded transaction sighash inside per-action signing loopReplaces magic byte-slice boundaries for encrypted ciphertexts with named, documented constantsNo change to cryptographic algorithms, data included in hashes, or signature verification logic
1596d47dby Adam Tucker+33−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): remove orphaned sign_message_orchard helper

This commit removes an unused helper function called sign_message_orchard from the Zcash code in a cryptocurrency hardware wallet firmware. The function was not being called anywhere in the codebase (orphaned/dead code), so removing it is …

Removal of cryptographic signing helper (dead code elimination)No caller sites shown in diffNo vendor claim of security relevance in commit message or title
eb08e34eby Adam Tucker+0−401 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 82 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: cover unused mempool space in coins cache

This is a routine test-only change. It adjusts an existing unit test to better exercise how Bitcoin Core's coin cache behaves when memory reserved for the mempool is not actually being used by the mempool. No production code was changed, s…

5d57f2ceby woltx+9−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: update LTS branches for toolchain and kani crons

This commit only changes three GitHub Actions workflow files that control scheduled CI jobs. It updates the list of long-term support (LTS) branches used by automated cron jobs, replacing one branch name with two placeholder-looking names …

183197abby Nick Johnson+3−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: cover disconnect on private broadcast peer with relay=false

This commit only adds a new automated test to Bitcoin Core. It verifies that when a node connects to a 'private broadcast' peer which signals it does not relay transactions (relay=false), the node disconnects that peer. There is no change …

1fc9277aby Bruno Garcia+27−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 88 · Strong
KX KruxKrux BitcoinHardware wallets

chore: remove unused color constants

This is a routine cleanup commit that deletes two unused color constants (LIGHTGREY and PURPLE) from a theme file. It does not change any behavior, fix any bug, or alter any security-related logic.

3c5f395cby qlrd+0−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API snapshot files to reflect that two existing types now expose a new public helper method called builder(). No actual source code changes are included, and there is no indication of a security fix or vu…

dc2418b3by Mitchell Bagot+4−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Move builder script functions to primitives

This commit is a routine internal code reorganization. It moves two helper functions that create a 'script builder' from one module to another within the same project. The functions themselves are unchanged, and there is no indication this…

16e93cacby Mitchell Bagot+11−104 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →