CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Informational 13 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): expand configurability of st-7789 display driver

This commit rewrites the ST-7789 display driver so that pin assignments, reset, power, and tearing-effect interrupt are controlled by board-specific macros instead of being hard-coded. It also adds a fallback code path for boards that do n…

61fafa5aby tychovrahe+94−247 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add support for dem240320b1 display panel

This commit adds support for a new display panel (DEM240320B1) used in some Trezor hardware wallets. It is purely a hardware-enablement change: it wires up the panel's initialization commands, screen resolution, and rotation handling so th…

9ef1c123by tychovrahe+215−05 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add T3T2 model

This commit adds support for a new Trezor hardware model, the T3T2. It is a product enablement change that introduces board definitions, memory layouts, bootloader hashes, vendor headers, and Python tooling entries for the new device. Ther…

8a382e8dby tychovrahe+860−334 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): extract backlight gamma correction to common file

This commit is a code cleanup: it moves the existing backlight brightness math into a shared header file and updates two hardware-specific backlight drivers to use it. There is no user-facing change, no bug fix, and no security change. It …

15b03938by tychovrahe+105−643 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: add p2p_private_broadcast harness

This commit adds a new automated fuzz test for Bitcoin Core's private transaction broadcast feature. It is purely a testing/quality-assurance change and does not modify any production networking or consensus code. There is no security vuln…

d24d3cbaby frankomosh+254−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 80 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Panic on unexpected chanmon monitor events

This change only affects an internal fuzz-testing harness, not production code. It makes the test harness crash with a clear error message if it encounters a ChannelMonitor event it doesn't know how to handle, instead of silently ignoring …

Test harness hardening onlyNo production code path modifiedNo cryptographic, network, or state-machine logic changed
3b46ec98by Joost Jager+9−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: reject trailing final witness data

This change tightens how a Bitcoin PSBT library extracts final witness data when turning a partially-signed transaction into a finished transaction. Previously, extra bytes after the declared witness stack were silently ignored. Now the li…

strict parsing of serialized witness datarejection of trailing bytes in PSBT final script witnesspotential malleability / ambiguity reduction in PSBT extraction
468853e4by Boris Nagaev+13−91 file
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: test final witness trailing data rejection

This commit adds a new test to the btcd PSBT (Partially Signed Bitcoin Transaction) library. The test checks that when extracting a final Bitcoin transaction from a PSBT, the library rejects a final witness value that has extra trailing by…

Strict parsing of final witness data to reject malformed/trailing bytesPrevents creation of transactions with non-standard witness encodingTest-only commit implies behavior enforcement elsewhere in the codebase
c87168ebby Boris Nagaev+26−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
LL Lightning LabsLND BitcoinLightning Network

ci: split PR severity workflow into classify and apply jobs

This commit is a hardening and cleanup of a GitHub Actions workflow that automatically labels pull requests by severity. It does not change any LND node code, wallet logic, or network protocol. Instead, it splits the workflow into two jobs…

Principle of least privilege: write token moved out of the model-bearing jobUntrusted input (model-generated comment) sanitized before privileged API useExternal action pinned to immutable commit SHA instead of mutable tag
05c62527by Olaoluwa Osuntokun+424−593 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
LL Lightning LabsLND BitcoinLightning Network

ci: split issue dedupe into find and post jobs

This commit is a hardening and refactoring change to a GitHub Actions workflow that detects duplicate issues. It splits the workflow into two jobs: one that only reads issue data and uses an AI model to find duplicates, and a second that o…

Principle of least privilege: AI/model job no longer holds issues:write or id-token:writeAction dependency pinned to full commit SHA instead of mutable tagpersist-credentials: false set on checkout steps
d1ea8687by Olaoluwa Osuntokun+148−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 81 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

android build: cache p4a recipe downloads even for FRESH_CLONE builds

This change is a build-system optimization for Electrum's Android release builds. It caches large Qt source downloads between builds so they are not repeatedly downloaded from the internet. There is no security vulnerability here.

dc1072c9by SomberNight+17−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

jade_cli: add selfcheck command

This commit adds a new command-line command called 'selfcheck' to the Jade CLI tool. It simply calls an existing device function and prints the result. There is no indication of a security fix or vulnerability being patched.

32d3c9a7by Jon Griffiths+10−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →