CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Informational 17 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): pull i2c only with touch drivers that need it

This is a small internal cleanup in the Trezor firmware's build configuration. It moves the requirement for an I2C bus from the generic 'touch' feature down to the specific touch-screen driver features that actually use it. There is no dir…

Refactor of hardware abstraction feature flagsNo changelog entry providedNo security keywords in commit title or message
e279921aby tychovrahe+5−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add support for D003 nucleo board

This commit adds support for a new Trezor development board called D003 (based on an STM32U5 Nucleo evaluation kit). It is purely an enablement change for internal hardware bring-up: new configuration files, memory layout, bootloader hash,…

bac4ac76by tychovrahe+490−334 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat(zcash): sign checked PCZTs with a single parse and in-memory postflight

This commit adds a new, more efficient way to sign Zcash shielded transactions on Keystone hardware wallets. Instead of parsing and serializing the transaction multiple times, it parses once, signs in memory, and verifies signatures before…

New in-memory post-sign verification path reduces opportunities for serialization/deserialization attacks or state mismatches.Previously discarded verifier output is now retained and propagated, eliminating a potential check-then-drop pattern.Single-parse path reduces attack surface by avoiding repeated PCZT parsing.
5354d2cfby Adam Tucker+199−152 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Move LoadGenesisBlock to ChainstateManager

This commit is a straightforward internal code reorganization: it moves the LoadGenesisBlock function from the Chainstate class to the ChainstateManager class, marks its return value as important to check, and slightly rewords two rare err…

fa615bd1by MarcoFalke+17−166 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat(zcash): add single-parse preflight that normalizes checked PCZTs

This commit refactors Zcash PCZT (Partially-Created Zcash Transaction) handling in the Keystone hardware wallet firmware so that parsing, security checks, and re-serialization can happen in a single pass. It does not remove any existing ch…

Refactors existing validation into reusable parsed-PCZT helpers without removing checksAdds new public preflight API that parses, validates, and re-serializes PCZT bytesIncludes tests for idempotent normalization and rejection of invalid/spoofed PCZTs
eb999d5fby Adam Tucker+127−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat(zcash): add ZcashCheckedPczt FFI container with digest binding

This commit adds a new Rust data container called ZcashCheckedPczt for the Zcash cryptocurrency support in the Keystone 3 hardware wallet firmware. It stores preflight-checked transaction bytes and a SHA-256 fingerprint (digest) so that la…

New defensive integrity container for Zcash transaction bytesSHA-256 digest stamped at preflight and verified before later useAdded FFI memory-free routine for the new container
3b0ac590by Adam Tucker+92−22 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(crypto): improve constant-time comparison

This commit hardens how Trezor compares secret values (passwords, PINs, cryptographic tags, and checksums) so that an attacker cannot learn information by measuring how long the comparison takes. It also adds a fault-injection check: if a …

Replaces non-constant-time memcmp with constant-time consteq in cryptographic tag verification paths (AES-GCM, Poly1305, base58 checksums, ed25519 signature verification, SLIP25 MAC)Adds volatile loop counter and loop-completion fault check in consteq to mitigate fault-injection skipping of the comparisonIntroduces tc_fault_handler() abstraction; production builds map it to a fatal error, while a no-op fallback is provided for tests/unconfigured builds
09864cb2by M1nd3r+156−6722 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Use a builder for sign_interactive_funding_tx arguments

This commit is a code cleanup inside the project's test suite. It replaces a helper function with several hard-to-read positional arguments (like bare `false` and `None`) with a 'builder' pattern that names each option. This makes the test…

ed250c02by Jeffrey Czyz+116−861 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

app-bitcoin-new rename to app-bitcoin - let's now use the docker image - already deployed after the push on develop

This commit simply updates a GitHub Actions workflow to use a renamed Docker container image. The old image name contained 'app-bitcoin-new' and the new name contains 'app-bitcoin'. This is a routine repository rename follow-up with no vis…

be18c501by Ilya Artemov+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Let's use so far existing app-bitcoin-new docker image

This commit simply updates the GitHub Actions CI workflow to use the correct Docker image name for the newer 'app-bitcoin-new' project instead of the old 'app-bitcoin' image. It is a build/test infrastructure change with no effect on the a…

18599aeaby Ilya Artemov+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

app-bitcoin-new rename to app-bitcoin

This commit is a simple repository rename from 'app-bitcoin-new' to 'app-bitcoin'. It changes only one line in a GitHub Actions workflow file, updating the Docker container image path used for automated testing. There is no code change, no…

5f68df41by Ilya Artemov+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: lower testpluguv's required python version

This commit is a test-only build fix. It lowers the minimum Python version required for a small test plugin from 3.13 to 3.10 so that the project's test tooling can install a dependency that currently fails to build on Python 3.14. It does…

ec7d544cby daywalker90+122−32 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →