CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core/caesar): shorten `confirm_summary()` text if possible

This is a minor user-interface polish change for the Trezor hardware wallet's Caesar layout. It removes an unnecessary blank line from transaction summary screens when either the amount label or the amount value is empty. There is no secur…

bee67ca2by Roman Zeyde+467−4652 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core/caesar): visit menu only on last page

This commit is a small test-only UI adjustment for the Trezor hardware wallet's Caesar layout. It changes when a menu icon is reported as visible in automated UI snapshots, limiting it to the last page of a multi-page flow. The code change…

7fa4a20fby Roman Zeyde+26−232 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 89 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): scope allocation of clear signing definitions

This commit changes how Trezor's Ethereum 'clear signing' helper data is loaded in memory. Previously, all definitions were stored in a permanent module-level list that MicroPython's garbage collector could not reclaim. The patch wraps the…

Memory pressure reduction: module-level rooted objects moved to generator-local scope to become collectable.No input validation, parsing, or cryptographic logic changed; only object lifetime and import scoping.No explicit security relevance disclosed by vendor; commit message frames change as a fix for garbage collection.
1dde2fa8by Roman Zeyde+1086−10842 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): inline `SC_FUNC_APPROVE_REVOKE_AMOUNT` constant definition

This commit is a minor code cleanup: it replaces a named constant with the literal number 0 in one place and removes the constant definition. There is no functional change, no bug fix, and no security relevance visible in the diff.

fe564511by Roman Zeyde+2−32 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 88 · Strong
BT btcsuitebtcd BitcoinNode implementations

btcec/schnorr: reject s >= group order in ParseSignature

This commit fixes a bug in how btcd parses Schnorr (BIP-340) digital signatures. The code was supposed to reject signatures whose 's' number was larger than the allowed group order, but instead it silently wrapped the value around (modulo …

BIP-340 signature parsing non-compliancesilent modulo reduction of s componentsignature malleability risk from non-canonical encodings
83d081a5by Lrifton92+42−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

rpcserver: use channel state open channel

This is a routine code cleanup in LND's RPC server. It changes several internal helper functions to accept a more specific 'chanstate.OpenChannel' type instead of the broader 'channeldb.OpenChannel' alias. The functions only read channel s…

4a34503cby ziggie+6−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

chanrestore: use channel state open channel

This is a one-line code cleanup change. It swaps which internal Go package provides an empty 'OpenChannel' data structure when building a restored channel shell. The actual fields being filled in are identical, and there is no functional c…

05bea1ddby ziggie+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

contractcourt: use channel state open channel

This commit is a straightforward internal code cleanup: it changes the contractcourt package to use a newly introduced chanstate.OpenChannel type instead of the older channeldb.OpenChannel alias. There is no functional change to how the Li…

e0b86913by ziggie+53−3615 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnwallet: use channel state open channel

This commit is a straightforward internal code cleanup: it changes the lnwallet package to use the OpenChannel type from a dedicated chanstate package instead of getting it indirectly through the channeldb package. There is no change to us…

fa31c564by ziggie+59−469 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

peer: use channel state open channel

This commit is a routine internal code cleanup in the LND lightning node software. It changes the peer package to use a new dedicated channel-state type (chanstate.OpenChannel) instead of an older alias from the channeldb package. There ar…

a459bc46by ziggie+22−193 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch: use channel state open channel

This commit only changes test helper code in LND. It swaps one internal type name (channeldb.OpenChannel) for another (chanstate.OpenChannel) inside test utilities. There is no change to production code, no user-facing behavior change, and…

a4bec71bby ziggie+6−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

chanstate: use channel types in local chans

This commit is a straightforward internal code cleanup. It changes one part of the Lightning Network Daemon (LND) to use a newer, more focused package called `chanstate` for representing open channel data, instead of the older, broader `ch…

a546c759by ziggie+19−162 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →