We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit simply removes an unused Python 3.7 CI Docker file and cleans up a leftover dependency for Python 3.6. There is no security issue here—it's routine housekeeping.
7ac09cf8by Sjors Provoost+2−274 filesThis commit simply updates web links and folder names in HWI's build scripts and documentation to match Ledger's renamed GitHub repositories. It does not change any wallet code, cryptography, or user-facing behavior. There is no security i…
f15d6d9aby Salvatore Ingala+8−83 filesThis change makes the hardware-wallet interface library stricter when reading PSBT (Partially Signed Bitcoin Transaction) files. It now rejects locktime values that don't follow Bitcoin's rules: a time-based locktime must be at least 500,0…
498e85a7by Sjors Provoost+8−12 filesThis commit fixes a parsing bug in the way the Hardware Wallet Interface (HWI) reads Bitcoin transaction files called PSBTs. PSBTs come in two versions, v0 and v2, and each version has its own allowed fields. The code was accidentally acce…
2a431b88by Sjors Provoost+22−42 filesThis change fixes a subtle parsing bug in how the wallet software reads PSBT (Partially Signed Bitcoin Transaction) files. Previously, the code could not tell the difference between a PSBT that genuinely contained an unsigned transaction w…
8a405230by Sjors Provoost+6−32 filesThis commit fixes a bug in how the wallet interface reads the unsigned transaction embedded inside a PSBT (Partially Signed Bitcoin Transaction). Previously, the parser tried to auto-detect whether the transaction included witness data, wh…
b34f94a6by Sjors Provoost+19−33 filesThis commit is a routine release-management update. It adds signed build assertions for three new BitBox02 firmware versions (9.26.2, 9.26.3, 9.26.4) and updates the release documentation and build helper script. The build script now delet…
eed2e68eby Marko Bencun+79−116 filesThis commit only deletes an incorrect explanatory comment. The actual code behavior does not change at all. It is a documentation cleanup, not a security fix.
980ccfd5by Tobin C. Harding+1−61 fileThis commit only reformats existing Zcash PCZT code—adjusting line breaks, indentation, and whitespace. No logic, behavior, or security checks were changed.
a759792cby Adam Tucker+26−233 filesThis commit simply removes one person (Pieter Wuille) from the list of security contacts in the project's SECURITY.md file. It is an administrative change to the documented contact list and does not alter any code, fix any bug, or change a…
629df81eby Pieter Wuille+0−11 fileThis commit is a routine developer tooling change. It turns on stricter Python type checking (Pyright) for the emulator script and some test helper scripts, and makes small code adjustments so those files pass the new checks. There is no c…
16a7a0b8by Martin Milata+34−259 filesThis commit only changes test infrastructure. It enables extra logging output during automated testing so developers can see more detail when running tests. There is no change to the actual Trezor firmware or wallet security code, and no s…
a22031d5by Martin Milata+7−01 fileA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.