CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17762Commits captured
17242AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17242 analyses
Highest risk·RSS
Low 44 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

bolt12: inject feature-bit catalogues into Offer and InvoiceRequest validators

This change updates how the LND code checks feature bits in BOLT 12 offers and invoice requests. Previously, the read-side validator treated every even feature bit as unknown and would reject it, because it had no list of known features. N…

Feature-bit validation logic changed from hard-coded nil catalogue to caller-supplied catalogueWrite-side feature enforcement removed entirelyRead-side now accepts even feature bits that the local node knows, rejects only unknown even bits
732b0413by bitromortac+61−182 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

bolt12: add Invoice struct and TLV codec

This commit adds new code to support BOLT 12 invoices in the LND Lightning node. It introduces a data structure, encoding/decoding logic, and helper functions to filter fallback addresses and blinded payment paths. There is no bug fix or s…

efbeef58by bitromortac+777−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): finish the preflight-to-check rename for the batch entry point

This commit is a pure rename refactor. It changes the word 'preflight' to 'check' in function names, variable names, test names, and comments across three files related to Zcash batch transaction handling. The commit message explicitly sta…

a208d1ddby Adam Tucker+24−243 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

pyln-proto: update coincurve to commit 7829b29c08ebb1cc80386a1cdaf8c2243c4ef5c5

This change swaps a Python cryptography helper library (coincurve) from a pinned released version to a specific unreleased commit on GitHub. The stated reason is a build failure caused by a newer release of the build tool scikit-build-core…

Dependency source changed from PyPI release to arbitrary Git commitBuild-time failure in upstream dependency triggered the changeNo CVE, advisory, or security-related changelog entry present
381c086eby daywalker90+7−502 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: Fix changelog 0.5.0 link

This commit fixes a typo in a changelog hyperlink. It changes one version number in a Markdown reference link so the comparison URL points to the correct previous release. There is no code change and no security relevance.

da7ae89dby Tobin C. Harding+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove hex dep from internals

This commit simply removes an unused software dependency (the hex-conservative crate) from the internals sub-package and updates related package configuration files. It is a routine cleanup change with no security relevance.

bd0d4bc0by Tobin C. Harding+8−118 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Add Manage Labels link to Bitcoin Wallet labels (#7435)

This commit is a straightforward user-interface convenience change: it adds a 'Manage Labels' link inside the label dropdown on wallet transaction and payment request pages. There is no security-relevant behavior change in the diff itself.

6901c0efby Nicolas Dorier+29−65 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 63 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: use in-memory SQLite for temporary wallet in exportwatchonlywallet

This change refactors how Bitcoin Core creates a temporary wallet during the exportwatchonlywallet command. Previously, the temporary wallet was written to disk in the wallets directory and then deleted afterward. Now it is kept entirely i…

Eliminates temporary wallet files written to disk during exportwatchonlywalletRemoves manual filesystem cleanup path that ran on both success and failureReduces attack surface related to leftover or partially-written wallet files
d1e7f8c9by Pablo Martin+26−315 files
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add regression test for in-memory SQLiteDatabase reopen

This commit only adds a new automated test. It checks that Bitcoin Core's in-memory SQLite wallet database correctly refuses to reopen after being closed, because reopening would silently create a fresh empty database and discard any previ…

Regression test for data-loss prevention behavior in wallet database layerIn-memory SQLite database reopen could silently discard wallet dataOpen() now throws std::runtime_error instead of returning a fresh connection
777d23f2by Pablo Martin+9−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: store m_additional_flags in SQLiteDatabase to fix reopen path

This patch fixes a bug in Bitcoin Core's SQLite wallet code where an in-memory test wallet could accidentally be reopened as a real on-disk database, or be lost entirely during error recovery. The fix stores the original database flags so …

Data-integrity bug in wallet database reopen pathIn-memory database could be silently reopened with different flagsConnection recovery path could discard wallet state for in-memory DBs
ee43743fby Pablo Martin+13−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(python): remove remaining TrezorClientDebugLink references [no changelog]

This commit is a routine cleanup: it updates one comment in a debug helper file and deletes two old developer-only snippet scripts that referenced an outdated class name. There is no change to the firmware, wallet logic, cryptography, or a…

64601614by Arnold K+1−4413 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

docs: root readme cleanup

This commit only edits the project's README.md file. It removes outdated CI badges, updates the recommended JSON-RPC client library, fixes changelog links, and adds missing crates to the changelog list. No code, build scripts, or cryptogra…

efeab943by Nick Johnson+17−191 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →