CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17600Commits captured
17165AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17165 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core): enable logging from tests and fixtures

This commit only changes test infrastructure. It enables extra logging output during automated testing so developers can see more detail when running tests. There is no change to the actual Trezor firmware or wallet security code, and no s…

a22031d5by Martin Milata+7−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: make python 3.12 the pyright baseline

This commit only changes configuration files for a Python type checker (Pyright) and removes an outdated comment in setup.cfg. It bumps the declared Python version used for type checking from 3.10 to 3.12. There is no change to the actual …

9c1a3a7cby Martin Milata+2−43 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): enable and start Tropic emulator by default

This commit changes how the Trezor firmware build and test tooling handles the Tropic secure-element emulator. Previously, Tropic support was disabled by default in Unix emulator builds and had to be explicitly enabled; now it is enabled b…

Default-disabled security component (Tropic emulator) is now enabled by default in emulator buildsTest harness now auto-starts an external model_server process for Tropic-capable modelsPort allocation widened to include a dedicated Tropic port per worker
afb0fdd4by Martin Milata+303−30116 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): fix Makefile indentation

This commit only fixes whitespace indentation in a Makefile. It moves a few conditional build-option lines from being indented with a tab to being flush-left, which is required for GNU Make to recognize them as part of the else branch rath…

b61fad10by Martin Milata+6−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): add option that prints basic emulator properties

This commit adds a new command-line option to the Trezor emulator that prints basic device information (model name, optional feature flags, and version number) as JSON and then exits. It also adds a Python helper to call this option. There…

35c98847by Martin Milata+49−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core): only start Tropic model if the Trezor emulator needs it

This commit changes test infrastructure so that the Tropic01 model (a separate emulator component) is only started when the Trezor emulator being tested actually supports it. Previously it was started by default. There is no indication thi…

eadb8c1aby Martin Milata+25−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

SECURITY.md: Align the table

This commit is purely cosmetic: it adjusts the spacing in a markdown table inside the SECURITY.md file so the columns line up visually. No code, keys, fingerprints, instructions, or security policy content were changed.

d5c64bafby Tim Ruffing+4−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

SECURITY.md: Add theStack's key

This commit simply adds a new person's PGP key to the project's SECURITY.md file. It is an administrative documentation change with no code modifications and no security vulnerability.

9bd50f0cby Tim Ruffing+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

eth: loosen EIP-712 identifier validation

This firmware update relaxes the rules for valid Ethereum typed-data (EIP-712) names so they can contain a colon (:), which some decentralized apps use as a namespace separator. Member names still cannot contain colons. The change is prese…

Input validation relaxation for externally supplied EIP-712 type namesExplicit claim that ':' cannot forge encodeType boundariesMember-name validation remains strict
9703d8d9by Marko Bencun+50−43 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

node: smooth oversized `-dbcache` warnings

This commit changes the warning threshold that tells Bitcoin Core users when their database cache setting (-dbcache) is too large for their computer's RAM. Previously, the threshold jumped sharply at exactly 2 GiB of total RAM. The new for…

d164a043by Lőrinc+27−252 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

chainparams: delete my DNS seed

A Bitcoin Core developer removed their own DNS seed (seed.bitcoin.sipa.be, run by Pieter Wuille) from the list of hardcoded network seeds that help new Bitcoin nodes find peers when they first start up. This is a routine operational/mainte…

Removal of a trusted bootstrap DNS seed from default chain parametersReduction in peer-discovery redundancy for new mainnet nodesNo vulnerability patch, cryptographic fix, or memory-safety change present
d9080639by Pieter Wuille+1−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Pin jobserver to 0.1.34 on pre-1.85 rustc

This commit adjusts the project's continuous integration (CI) test script to pin an older version of a build-time helper crate called `jobserver` when using older Rust compilers. It is a build compatibility fix, not a security patch, and d…

a4641403by Matt Corallo+3−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →