Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

chanstate: use channel types in fitness

This commit is a small internal code cleanup in LND's channel-fitness subsystem. It swaps one internal Go data type for another equivalent one (moving from channeldb to a newer chanstate package) in test and production code. There is no us…

19e656b2by ziggie+9−63 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

chanstate: use htlc type in beacon

This commit is a small internal code cleanup. It changes one function to use a different internal data type for HTLC (payment channel transaction) information, moving from a database-specific type to a channel-state type. There is no secur…

471c9b69by ziggie+5−42 files
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Tolerate stale STFU warnings in chanmon fuzz

This commit changes only a fuzzing test harness (a tool that randomly exercises code to find bugs). It teaches the test harness to accept a specific warning message as expected when a test delivers an outdated 'STFU' message after a channe…

Fuzz harness adjustment onlyNo production protocol logic changedComment explicitly states stale events are still delivered to exercise normal error paths
13c97eb5by Joost Jager+15−01 file
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Filter stale closed hop sends in chanmon fuzz

This change only modifies a fuzzing test harness, not the production Lightning Dev Kit code. It adds a filter so that simulated multi-hop payments skip test scenarios where the harness's view of a closed channel is temporarily out of sync …

Change is confined to fuzz test harness code (`fuzz/src/chanmon_consistency.rs`)No modifications to production networking, routing, or channel state machine logicCommentary describes a test-state inconsistency, not a real-world protocol failure
53b399c4by Joost Jager+34−01 file
No security note in commit
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: cover -externalip/onlynet interaction in functional test

This commit only adds a new automated test to Bitcoin Core. It checks that a user-configured onion address still gets advertised even when the node is told to only use IPv4. There is no code change to the actual Bitcoin node behavior, so t…

dab7f2c9by will+14−01 file
No security note in commit
Informational 14 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: cover -externalip bypassing -onlynet

This commit only adds a new automated test to Bitcoin Core. It checks that the -externalip command-line option can bypass the -onlynet restriction when a user explicitly configures an external address, while normal local-address registrati…

657a5aa3by will+43−01 file
No security note in commit
Informational 22 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net: let -externalip bypass -onlynet

This commit fixes a configuration bug in Bitcoin Core. Previously, if a user told their node to only use one network type (for example, only IPv4) and also manually set an external address on a different network (for example, a Tor onion a…

Configuration-behavior fix: explicit user override now honoredNo new attack surface: bypass is limited to user-supplied -externalipNo changes to validation, consensus, wallet, or P2P protocol parsing
8c87e32bby will+2−22 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net: add an add_even_if_unreachable argument to AddLocal

This commit is a small, non-functional code cleanup. It adds a new optional parameter to an internal networking function so that a future change can allow user-specified local addresses to bypass a network-reachability check. The new param…

f4af02e8by will+5−52 files
No security note in commit
Low 34 AI analysisMessage 88 · Strong
AQ ACINQEclair BitcoinLightning Network

Refactor attribution data (#3320)

This commit is a code refactor of how Eclair handles 'attribution data'—extra encrypted timing and accountability information attached to Lightning payment success and failure messages. It restructures the code to support future trampoline…

Refactor of cryptographic attribution-data creation/verificationNew shared-secret extraction path parses trampoline onion and path-key/blinded-path stateAttribution data now explicitly suppressed for blinded-route intermediate nodes
4b9ba010by Bastien Teinturier+228−1096 files
No security note in commit
Low 29 AI analysisMessage 65 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: add wallets search option, allow loading hidden wallet iff search string matches exact wallet name

This commit adds a search box to Electrum's mobile-style QML wallet list. It also changes how 'hidden' wallets (those whose filenames begin with a dot) are handled: previously they were blocked entirely, now they are allowed but kept out o…

GUI now permits loading wallets with dot-prefixed filenames that are otherwise hidden from the listExact-name match is required to load a hidden wallet, reducing accidental or brute-force discoveryValidation still rejects '..' prefixed filenames and path separators
836ef252by Sander van Grieken+51−52 files
No security note in commit
Informational 23 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): make rotation_index optional

This commit loosens a data-format rule for a Trezor feature called Evolu. It changes the `rotation_index` field in an 'EvoluRegistrationRequest' message from 'must be provided' to 'may be omitted'. The stated reason is to fix a compatibili…

Relaxation of a required field to optional in a registration protocol messageRemoval of a presence check in generated Rust message validationNo mention of security impact, CVE, or vulnerability in commit message or diff
01aa1bffby Martin Pastyřík+7−104 files
No security note in commit
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this