CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17692Commits captured
17209AI analyses
96High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17209 analyses
Highest risk·RSS
Low 31 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: store m_additional_flags in SQLiteDatabase to fix reopen path

This patch fixes a bug in Bitcoin Core's SQLite wallet code where an in-memory test wallet could accidentally be reopened as a real on-disk database, or be lost entirely during error recovery. The fix stores the original database flags so …

Data-integrity bug in wallet database reopen pathIn-memory database could be silently reopened with different flagsConnection recovery path could discard wallet state for in-memory DBs
ee43743fby Pablo Martin+13−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(python): remove remaining TrezorClientDebugLink references [no changelog]

This commit is a routine cleanup: it updates one comment in a debug helper file and deletes two old developer-only snippet scripts that referenced an outdated class name. There is no change to the firmware, wallet logic, cryptography, or a…

64601614by Arnold K+1−4413 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

docs: root readme cleanup

This commit only edits the project's README.md file. It removes outdated CI badges, updates the recommended JSON-RPC client library, fixes changelog links, and adds missing crates to the changelog list. No code, build scripts, or cryptogra…

efeab943by Nick Johnson+17−191 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Remove redundant witness program check

This is a small code cleanup that removes an unnecessary duplicate check when validating Bitcoin output scripts during Lightning channel funding. The old code first asked 'is this a witness program?' and then separately asked 'what is its …

No security-relevant behavior change in the diffChange is a defensive-input validation cleanup, not a fixNo new attack surface introduced
47a090aaby Abeeujah+1−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add amounts to HTLC locators

This commit adds the HTLC amount (in milli-satoshis) to the data structures LDK uses to locate forwarded payments. It is a feature/enhancement change: callers of the PaymentForwarded event can now see per-HTLC amounts when a forward involv…

No memory-safety issues introduced (Rust, optional u64 field)No new panics, unwraps, or arithmetic on untrusted values beyond existing fee mathSerialization uses existing TLV framework with optional fields, preserving backward compatibility
588054e4by benthecarman+99−106 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Fix listconfigs and lightningd-config documentation

This commit is a documentation and generated-code synchronization fix. It updates the list of configuration options returned by the listconfigs RPC, marks several old options as deprecated, and regenerates the matching gRPC/JSON schema/Rus…

No security-relevant code changesGenerated schema/model synchronization onlyDeprecation metadata added for removed options
9c378dd2by ShahanaFarooqui+1683−63510 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Archive 30.3 release notes

This commit simply archives the written release notes for Bitcoin Core version 30.3. It adds a new documentation file listing what changed in that release, but does not change any program code, configuration, or build scripts. There is no …

443179a9by Ava Chow+167−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct CHANGELOG dates on 0.2.1 and 0.2.2

This commit only fixes two release dates in the project's CHANGELOG.md file, changing the years for versions 0.2.1 and 0.2.2 from 2025 to 2026. There are no code changes, no security fixes, and no functional impact.

253018caby Matt Corallo+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

CODEOWNERS: add daywalker90 as owner of bip353, currencyrate, and clnrest plugins

This commit only updates the GitHub CODEOWNERS file, which assigns reviewers to certain plugin directories. It does not change any source code, build scripts, or runtime behavior of Core Lightning. There is no security-relevant change.

90c27f91by daywalker90+20−151 file
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 97 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix(zcash): preflight the batch in the QR display path

This commit fixes a bug in the Keystone 3 hardware wallet's Zcash QR-code batch transaction flow. Previously, scanning a Zcash batch QR code skipped a required safety preflight check, causing the wallet to fail with a confusing 'no checked…

Missing input validation / preflight bypass in QR code display pathNULL-checked container used before populationError-message surfacing improved to avoid generic failure dialogs
0e3f4232by Adam Tucker+36−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

docs: update LTS versions and expand on policy

This commit only edits a documentation file describing which versions of the rust-bitcoin project are supported long-term. It removes detailed dependency tables and updates the list of maintained LTS branches. There is no code change and n…

d704b494by Nick Johnson+12−481 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

http: check rpcallowip immediately after accepting connection

This Bitcoin Core change moves the IP allow-list check for RPC connections so it happens immediately when a connection is accepted, rather than after the server has already started processing the HTTP request. Previously, a blocked client …

Defense-in-depth: ACL enforcement moved earlier in connection lifecycleBehavior change: disallowed clients no longer receive an HTTP 403 response; connection is closed at accept timeRefactor of security-critical access-control state from global static to class member
d1ed2a6eby Matthew Zipkin+75−397 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →