CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Informational 18 AI analysisMessage 100 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

android build: patch hostpython3 to not install setuptools

This change adjusts how the Electrum Android app is built so that the build process installs only one specific, checked version of a helper library called setuptools, instead of accidentally ending up with two copies. Having two copies cou…

Build reproducibility / deterministic build hardeningSupply-chain adjacent: prevents co-installation of unpinned and pinned versions of setuptools during Android buildNo runtime code change to Electrum wallet logic
6b79d166by f321x+39−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 82 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: align test better with described scenario

This is a tiny change to a single unit test in Bitcoin Core. It swaps which test transaction is used in one assertion so the test matches the scenario described in the comment above it. There is no change to production code, no security fi…

191bdcbaby stickies-v+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

private broadcast: remove no-op [[nodiscard]]

This is a trivial code-cleanup commit. It removes a duplicate [[nodiscard]] marker from a function definition in a source file, because the same marker is already present on the function's declaration in the header file. The duplicate had …

8ac22248by stickies-v+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

build: move default FRESH_CLONE location from /tmp to /var/tmp

This commit simply changes the default temporary directory used during Electrum's build process from /tmp to /var/tmp. The reason is practical: many Linux distributions now put /tmp in memory (RAM disk), and the Android build needs to stor…

cd25fe4aby SomberNight+4−44 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

rpc: define and use new RPC_LIMIT_EXCEEDED error code

This commit changes the error code returned when Bitcoin Core's private broadcast transaction queue is full. Previously, the node reported an 'out of memory' error (-7), which was misleading because the server is not actually running out o…

No vulnerability signal: change is an error-code correction, not a memory-safety or authorization fixNo attacker-controlled code path introducedNo change to resource limits or queue eviction policy
82a02a2aby stickies-v+3−23 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use BOOST_CHECK_EQUAL for PrivateBroadcast::AddResult

This commit only changes test code. It swaps generic true/false checks for equality checks on an enum and adds a helper so that if a test fails, the output shows the actual enum value (e.g., 'QueueFull') instead of just 'false'. There is n…

7ad311beby stickies-v+21−101 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 99 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core): don't fail codec_v1 `sync_responses()` on unexpected magic

This is a small test-infrastructure change for the Trezor hardware wallet. It makes the test harness more tolerant of unexpected protocol responses and logs the full error trace instead of immediately stopping the entire pytest session. It…

Change is confined to test framework and host-side Python test libraryNo firmware or cryptographic code is modifiedNo privilege boundary, authentication, or asset-handling logic is changed
ddcea46bby Roman Zeyde+5−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add newline after heading on new_witness_program_unchecked

This commit only adds blank lines inside documentation comments for three internal helper functions. It changes no executable code, no APIs, and no behavior, so it has no security relevance.

682f1989by Mitchell Bagot+3−03 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: avoid call bumpfeediscount with negative values

This commit fixes a crash bug in Bitcoin Core's wallet coin selection. When the wallet tried to estimate fees for spending unconfirmed coins, it took two separate snapshots of the mempool. If the mempool changed between those snapshots—suc…

Assertion failure from negative value passed to fee-discount helperRace between two mempool snapshots used in the same coin-selection calculationprioritisetransaction can flip the sign of the computed discount
3ae3a94fby Pol Espinasa+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

A note added to README.md

This commit only adds a short note to the README.md file explaining that the repository was renamed. There are no code changes, no security fixes, and no functional changes to the Ledger Bitcoin app.

be0f6e90by Ilya Artemov+7−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

app-bitcoin-new rename to app-bitcoin

This commit is a simple project rename from 'app-bitcoin-new' to 'app-bitcoin'. It only updates URLs, repository references, and documentation strings across 17 files. There are no code logic changes, no security fixes, and no behavior cha…

3975774bby Ilya Artemov+21−2117 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 53 AI analysisMessage 73 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Allow exporting BIP-87 xpubs without explicit user approval

This commit expands an existing feature that lets a connected computer request extended public keys (xpubs) from a Ledger device without requiring the user to press 'Approve' on the device screen. It now allows this silent export for BIP-8…

Silent export of sensitive key material extended to an additional derivation standardNo user confirmation for xpub export on newly added BIP-87 pathsChange is framed by commit author as consistency improvement, not vulnerability remediation
08f5d1aaby Salvatore Ingala+1−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →