CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17609Commits captured
17169AI analyses
89High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17169 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Redeclare variable as signed in `util_tests`

This is a minor fix to a unit test file. A test variable was being assigned a negative value in an unsigned container, which caused a silent underflow and made the test assertion technically incorrect. The patch changes the test to check t…

cd2a4bc5by rustaceanrob+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 45 · Thin
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

update CHANGES.md for release 1.5.5

This commit is just a changelog update for libwally-core version 1.5.5. It mentions that the release 'de-optimizes some memcpy calls on x86 to prevent leaks via extended registers.' That wording suggests a security-sensitive fix, but the a…

Changelog entry describes a security-motivated fixMentions prevention of information leaks via CPU extended registersRelates to secure memory handling of cryptographic secrets
d0ac03baby Jon Griffiths+5−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

Bump version to 1.5.5

This commit is a routine version bump from 1.5.4 to 1.5.5 across build files, documentation, and package metadata. It changes only version strings and the build version constant; no code logic is modified.

78499f00by Jon Griffiths+12−129 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

sweep: account for aux extra budget when filtering inputs

This commit fixes a bug in LND's transaction sweeping logic that could permanently strand certain custom-channel (asset) outputs. The sweeper's budget filter was ignoring extra funds contributed by an optional 'aux sweeper' helper, so it w…

Denial-of-service / fund stranding: custom-channel outputs could be silently excluded from all future sweepsFee-ratchet interaction: non-fee failures (wallet UTXO collisions) could raise startingFeeRate and trigger the filterMissing budget accounting: filter did not mirror set-construction logic that already used aux extra budget
a9e3e9aeby Jared Tobin+151−43 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: add release note

This commit only adds a release note describing a previously fixed bug in LND's sweeper logic. It does not change any code, so it cannot introduce or fix a security issue by itself. The described bug relates to fee budgeting for sweeping c…

No code changesDocumentation-only commitReferences a prior bug fix (PR #10897) in release notes
3ae31b76by Jared Tobin+8−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

docs(zcash): fix stale anchor-redaction rationale in the Ironwood sign test

This commit only updates a code comment in a Zcash test file. It corrects an outdated explanation about why an anchor value can be removed during signing. No code behavior was changed, and there is no security issue present in the diff.

5c8da744by Adam Tucker+4−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

ci: re-enable clear tests

This commit only changes the project's continuous integration (CI) configuration. It re-enables a set of tests called 'clear tests' that were previously disabled in automated build pipelines, and adds a compiler warning suppression for an …

1009497bby Jon Griffiths+4−41 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 68 AI analysisMessage 73 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

internal: avoid potential info leaks via sse/avx registers

This commit fixes a potential information leak in a cryptocurrency wallet library. When the library is built as a shared library on x86/x86_64 systems, optimized memory-copy functions can leave secret data (private keys, seed phrases, chai…

Information disclosure via CPU register spill to stackShared-library/PLT-specific side channelUse of SSE/AVX registers by optimized libc memcpy
91b3b6d6by Jon Griffiths+96−3610 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 55 · Thin
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

tests: add more test_clear tests

This commit only adds new test cases to an existing test file. It does not change any production code, fix a bug, or alter behavior. The tests check whether sensitive secret bytes are cleared from the call stack after using certain cryptog…

Adds stack-clearing regression tests for secret-handling functionsUses a distinct sentinel value to avoid false positives from BIP39 testsTargets sensitive operations: BIP32 seed derivation, EC private key verification, ECDSA signing, and HMAC-SHA256
9d05ca17by pythcoiner+67−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 73 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

internal: mark internal functions as hidden visibility when possible

This change is a hardening patch for a cryptocurrency wallet library. It tells the compiler to keep certain internal helper functions private to the library, so calls to them stay inside the library instead of going through an external loo…

Hardening against secret material leakage via stack spillsCompiler/linker visibility hardeningPLT/GOT indirection reduction
2d36c91dby Jon Griffiths+78−555 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Properly format Custom Range in date range selector (#7439)

This commit fixes how a custom date range is displayed and submitted in BTCPay Server's web interface. It changes the way the browser's timezone is sent back to the server and how date/time inputs are pre-filled. There is no clear security…

No explicit security relevance stated in commit title or messageChanges input handling and form submission for date/time filtersRemoves a named form input (TimeZone) and replaces it with a submit button carrying a structured command
6c9d715fby Nicolas Dorier+82−327 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): rename redacted PCZT signing helper

This commit is a simple rename of an internal function from `sign_pczt_to_pczt` to `sign_and_redact_pczt` in the Zcash Rust code. No behavior, logic, or security properties changed; it only makes the function name more descriptive. There i…

01bd8e2bby Adam Tucker+4−42 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →