CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17562Commits captured
17152AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17152 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: only match Ledger "To" screen on the title row

This commit fixes a flaky automated test for Ledger hardware wallets. The test script was pressing an extra button because a randomly generated Bitcoin address happened to end in the letters 'To', which matched a screen-title rule. The fix…

d3e4ce7cby Sjors Provoost+21−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 100 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core): try to avoid old emulators' crashing during upgrade tests

This commit is a test-only workaround that adds a one-second sleep in an upgrade test script for older Trezor emulator versions. It avoids a known emulator crash during automated recovery tests when debug and wire communication are used si…

test-only changeworkaround for emulator crash in CI/upgrade testsreferences prior memory optimization (#1725) and crash issue (#7052)
468b7d75by Roman Zeyde+6−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: archive release notes for v29.4

This commit simply archives the release notes for Bitcoin Core version 29.4. It adds a documentation file summarizing bug fixes and improvements from other already-merged changes. No code was changed, and there is no new security issue int…

9b2b3f4eby fanquake+107−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

diy: Add M5StickC Plus2 backlight brightness control

This commit adds a screen brightness control feature for the M5StickC Plus2 hardware variant of the Blockstream Jade device. It is a hardware-support and user-interface change, not a security fix or vulnerability. There is no indication of…

5c22b7d3by oroderico+71−84 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 88 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: don't overwrite PSBTv2 tx version and fallback locktime

This commit fixes a bug in how the HWI library handles a newer Bitcoin transaction format called PSBTv2. Previously, when converting or setting up a PSBTv2 object, the code would accidentally overwrite the transaction's version number and …

Signature invalidation through mutation of transaction version/locktimeIncorrect null-check on PSBTv2 placeholder transaction objectPSBTv2 serialization round-trip failure for valid BIP 370 vectors
ca2caf04by Sjors Provoost+31−43 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: add remaining BIP 174 and BIP 370 test vectors

This commit only adds more test data to a JSON file used by the project's test suite. It adds additional encoded PSBT (Partially Signed Bitcoin Transaction) examples from official BIP test vectors. The commit message explicitly says these …

df8c3f5dby Sjors Provoost+27−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 82 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: add BIP 370 timelock determination vectors

This commit only adds new test cases for an existing function that determines lock times in PSBTs (Partially Signed Bitcoin Transactions). It does not change any production code, fix a bug, or alter behavior. There is no security issue her…

1ff27e02by Sjors Provoost+29−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Update enum class constant naming style guide

This commit only changes a style guide in the project documentation. It removes 'ALL_CAPS' as an acceptable naming style for enum class constants and explains that this avoids clashing with macros. No code, build scripts, or security behav…

fad5809cby MarcoFalke+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 75 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: assume final sequence when PSBT_IN_SEQUENCE is omitted

This commit fixes a crash in the PSBT (Partially Signed Bitcoin Transaction) handling code. When a transaction input did not specify a sequence number, the software would crash with an assertion failure instead of assuming the standard def…

Denial-of-service vector: assertion failure on malformed/minimal PSBT inputNon-compliance with BIP 370 default sequence semanticsCrash triggered by external PSBT data (parser robustness issue)
f0520e7eby Sjors Provoost+11−22 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 73 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: set locktime on the transaction, not the PSBT

This commit fixes a bug where a transaction's locktime (a time-based or block-height-based restriction on when a Bitcoin transaction can be mined) was being set on the wrong object. Instead of assigning it to the actual transaction, the co…

Incorrect assignment of locktime to PSBT object instead of transactionLocktime bypass: intended time/block-height restrictions silently ignoredPSBTv2 to PSBTv0 conversion path affected
2db24a2aby Sjors Provoost+5−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

ci: drop cirrus leftovers

This commit is a routine cleanup of leftover continuous-integration (CI) files. It removes an old Cirrus CI Dockerfile, updates two comment lines in other Dockerfiles, and swaps the build-status badge in README.md and setup.py from Cirrus …

9ded73e0by Sjors Provoost+4−1035 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →