CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 73 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

libjade: accept non-literal tags in mocked ESP_LOG macros

This is a small build-fix change. The project has mock versions of ESP logging macros used when building on a regular computer (host build). Previously these macros treated the log tag as a string literal, which broke compilation when a mo…

121adaadby odudex+5−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

Add TTGO T-Display backlight brightness control

This commit adds a screen brightness control feature for the TTGO T-Display development board used with Blockstream Jade. It is a hardware-support change, not a security fix or vulnerability. There are no security signals in the code or co…

b28e145cby oroderico+71−104 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

ci: avoid downloading artifacts for non-flash testing

This commit only changes CI (Continuous Integration) pipeline configuration. It tells certain automated test jobs not to download build artifacts from previous stages because those tests do not need them. There is no change to the actual J…

d786cefaby Jon Griffiths+4−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add negative zero CSV failure script test vector

This commit only adds a new test case to Bitcoin Core's script test suite. It verifies that a special edge-case number ('negative zero') is treated as plain zero by the CHECKSEQUENCEVERIFY opcode and therefore fails with the expected 'unsa…

c4068cf3by azuchi+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add CHECKLOCKTIMEVERIFY failure-path script test vectors

This commit only adds new test cases to a JSON test file for the Bitcoin Core test suite. It exercises ways the CHECKLOCKTIMEVERIFY (CLTV) script operation can fail, but does not change any production code, consensus rules, or network beha…

37edf0e2by azuchi+13−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

github: bump gateway code-review to v0.5.0

This commit updates a GitHub Actions workflow for an optional code-review bot called 'gateway' from version 0.4.4 to 0.5.0. It adds support for replying to inline review comments (not just regular PR comments) and pins the new action and r…

Workflow-only change with no modifications to LND application codeAction and runtime pinned to immutable commit SHAs (supply-chain mitigation)New pull_request_review_comment trigger added; commit message asserts same fork-PR secret safety as issue_comment
447703a4by saubyk+20−61 file
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Store splice contributions with their negotiated candidates

This commit refactors how a Lightning node keeps track of money it adds during splice and RBF (fee-bump) negotiations. Previously, the node's own contributions were stored in a separate list that had to be manually aligned with negotiated …

Refactor of splice/RBF contribution tracking to prevent misattribution between negotiation roundsAdded invariant assertions that contributions form a suffix of negotiated candidatesSerialization compatibility design to make older LDK versions refuse RBF states they cannot operate
707d65ceby Jeffrey Czyz+229−1131 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

CODEOWNERS: add self as owner of xpay/askrene/renepay

This commit only updates the GitHub CODEOWNERS file to assign one developer as the automatic reviewer for several plugin directories and their test files. It makes no code changes and has no security relevance.

2d367befby Lagrang3+6−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add default_rpc_port method to NetworkExt trait

This commit adds a simple helper function that returns the default Bitcoin JSON-RPC port number for each supported network (Bitcoin mainnet, Signet, Testnet versions, and Regtest). It is purely additive: it exposes no new network service, …

dd81148aby jaoleal+34−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Require `htlc_value_satoshis` in [pending] `HTLCUpdate`s

This commit removes the 'Option' wrapper from several HTLC amount fields, making them required instead of optional. It is a cleanup/refactoring change that simplifies the code by assuming the amount is always known. The commit message fram…

Removal of Option wrapper for financial amount fieldsSerialization format change from optional to required TLV fieldsLoss of backward compatibility with older serialized monitor/channel state
40957aadby Matt Corallo+24−284 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: add release notes for 32800

This commit only adds release notes describing a prior code change (PR #32800). It documents that several RPC calls now expose two separate virtual-size fields and that the old `vsize` field is deprecated. There is no code change here, onl…

29b12441by Musa Haruna+9−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

rpc: add `vsize_adjusted` field to getrawtransaction output for mempool transactions

This commit adds a new read-only field called vsize_adjusted to the getrawtransaction RPC output, but only when the transaction is currently in the memory pool. It exposes information the node already calculates for mempool policy, so it d…

No security-relevant signals presentAdditive RPC field onlyRead-only data exposure from existing mempool state
5d25a0c2by Musa Haruna+20−02 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →