CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17602Commits captured
17166AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17166 analyses
Highest risk·RSS
Moderate 57 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): remove checked PCZT digest stamp

This commit removes a security check that verified a Zcash transaction buffer had not been tampered with between the 'check/review' screen and the 'sign' step on a Keystone hardware wallet. Before the change, the device stored a fingerprin…

Removal of a digest-based integrity check on a signing input bufferRenaming of verified_bytes() to checked_bytes() with weakened semanticsCross-language (C/Rust) boundary no longer re-validates buffer contents
cf6b75c8by Adam Tucker+14−362 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core/python): create testing module in trezorlib

This commit is a routine code reorganization: it moves existing test-only helper code from the project's internal test directory into the public `trezorlib` Python package as a new `testing` module. The moved code includes utilities for ha…

493be197by Lukas Bielesch+814−46753 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

test(zcash): clarify Sapling fixture omission

This is a one-line comment change in a Zcash test file. It rewords an explanatory note about why a test sample lacks a Sapling bundle. No code behavior changes, no security fix or vulnerability is introduced.

c2fbb6d4by Adam Tucker+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

test(zcash): clarify PCZT wire prefix fixture

This commit only renames a test-only helper struct and updates comments in unit tests for Zcash PCZT (partially-created transaction) handling. It makes no changes to production code, cryptography, transaction parsing, or wallet behavior. T…

004c6143by Adam Tucker+17−181 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add test for index commits ahead of the last flushed block

This commit only adds a new automated test to Bitcoin Core. It does not change any production code, so it cannot by itself introduce a vulnerability or fix one. The test checks that an internal database index does not save progress beyond …

New regression test for index/chainstate flush consistencyNo changes to consensus, networking, wallet, or index implementation codeTest-only change with no runtime attack surface
13c02b54by Martin Zumsande+60−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): collapse checked PCZT helpers

This commit is a straightforward code cleanup in the Zcash PCZT (Partially Created Zcash Transaction) handling code. It merges two nearly identical internal helper functions into one shared helper that takes a policy argument, and removes …

No security-relevant logic change: validation order, error handling, and policy enforcement are preserved.No new unsafe code, no new dependencies, no new FFI boundaries, no cryptographic changes.Function visibility changes: `check_parsed_pczt_*` private helpers removed; `check_pczt_cypherpunk_with_policy` is private; public API surface unchanged.
8127079dby Adam Tucker+52−621 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): increase individual test timeout for upgrade tests

This commit only increases a test timeout value in a GitHub Actions CI workflow from 60 to 70 seconds. It does not change any firmware code, cryptographic logic, or user-facing behavior. There is no security relevance.

5e4aec49by Martin Milata+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

test(zcash): trim legacy v6 rejection comments

This commit only removes explanatory comments from three Zcash test files. No code behavior, logic, or security checks were changed. It is a documentation cleanup inside test code and has no security relevance.

feba63edby Adam Tucker+0−93 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Redeclare variable as signed in `util_tests`

This is a minor fix to a unit test file. A test variable was being assigned a negative value in an unsigned container, which caused a silent underflow and made the test assertion technically incorrect. The patch changes the test to check t…

cd2a4bc5by rustaceanrob+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 45 · Thin
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

update CHANGES.md for release 1.5.5

This commit is just a changelog update for libwally-core version 1.5.5. It mentions that the release 'de-optimizes some memcpy calls on x86 to prevent leaks via extended registers.' That wording suggests a security-sensitive fix, but the a…

Changelog entry describes a security-motivated fixMentions prevention of information leaks via CPU extended registersRelates to secure memory handling of cryptographic secrets
d0ac03baby Jon Griffiths+5−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

Bump version to 1.5.5

This commit is a routine version bump from 1.5.4 to 1.5.5 across build files, documentation, and package metadata. It changes only version strings and the build version constant; no code logic is modified.

78499f00by Jon Griffiths+12−129 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →