CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 65 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

script: make new_p2wsh available on hashable scripts

This is a small API change in a Bitcoin library written in Rust. It moves a helper function that creates P2WSH (pay-to-witness-script-hash) output scripts so it can be used on more script types. There is no indication this fixes a security…

5d339e84by weifanglab+13−72 files
No security note in commit
Open full analysis →Source commit ↗
High 71 AI analysisMessage 50 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

enhance the data content checking on the boot update logic

This commit adds safety checks to the bootloader update code in a cryptocurrency hardware wallet. Before the change, the firmware could trust attacker-controlled length values read from a staged update image, potentially allowing a malicio…

Length value from untrusted staged image used as loop bound and copy size before validationFixed-size 4 KB buffer g_fileUnit copied into with a length derived from external inputAddition of bootLen bounds check against header size and partition size
b10a29b0by aaron+13−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 69 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Limit SD erase file size

This commit fixes a bug in how the BitBox02 hardware wallet wipes files from its SD card. Before erasing a file, the device now checks the file's reported size against a safe maximum. Without this check, a tampered SD card could claim a fi…

CVE-2026-6682 referenced in commit messageMalformed FAT directory entry could cause excessive overwrite loopDenial-of-service via SD card tampering
2453f528by Marko Bencun+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 70 AI analysisMessage 66 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Validate mounted FAT geometry

This update adds a safety check when the BitBox02 hardware wallet mounts a microSD card. A malicious or deliberately malformed FAT filesystem could trick the device's file-system library into placing user data inside attacker-controlled bo…

Fixes integer-wrap / geometry confusion in FAT mount logicAdds explicit post-mount validation of filesystem metadataPrevents data area from landing inside attacker-controlled FAT sectors
01c017d6by Marko Bencun+21−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 69 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Update FatFs to R0.16

This commit updates the third-party FatFs file-system library inside the BitBox02 firmware from version R0.14b to R0.16 plus an upstream patch. The change is a routine dependency refresh: it replaces the vendored source files with the newe…

Third-party dependency update (FatFs R0.14b -> R0.16+p1)No explicit security claim in commit messageNo CVE or advisory referenced in commit or supplied references
9f2b493dby Marko Bencun+3842−256979 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add gitignore for Cargo.lock.backup

This commit adds one line to the project's .gitignore file so that backup files named Cargo.lock.backup are ignored by Git. It is a routine housekeeping change with no security relevance.

38f46d82by Tobin C. Harding+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

api: regenerate api snapshots

This commit only updates automatically-generated API snapshot text files. The snapshots now show that some error and I/O types are reported as coming from Rust's `core` library instead of the `std` library. This is a documentation/test-art…

42f8ddb2by satsfy (Renato Britto)+34−342 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix "File traversal detected" crash processing plugin commands on Windows (#7422)

This commit fixes a bug in BTCPay Server's plugin system where a safety check that prevents directory traversal attacks was accidentally rejecting valid plugin names on Windows. The original code always appended a '/' slash, but Windows us…

Path traversal guard present and being repairedUse of Path.GetFullPath and directory-prefix check for sandboxingFix for cross-platform path separator mismatch
a8c01be5by Andrew Camilleri+4−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 76 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

ccan: update ccan to fe99a8e0

This commit updates an internal sorting library used by Core Lightning. The old sorting code could call a comparison function with the exact same item twice when sorting arrays where every element is equal. The commit replaces that old cod…

Old quicksort fallback called comparator with identical pointers on all-equal arraysComparator contract violation: pointer identity no longer implies distinct elementsSorting routine replaced with glibc mergesort+heapsort to avoid self-comparisons
cb07b8cbby Níckolas Goline+479−2474 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Automated update to rustc nightly-2026-07-02

This is a routine automated update that changes the pinned Rust nightly compiler version in the project's configuration file from one recent nightly to another. There is no code change, no bug fix, and no security-relevant content.

30334cbeby Update Nightly Rustc Bot+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

units: refactor variable initialization location

This is a minor code cleanup in the rust-bitcoin library. It moves where a variable is first given a value so that the Rust compiler stops warning about unnecessary late initialization. There is no change to program behavior, no bug fix, a…

cf6c1a52by satsfy (Renato Britto)+5−61 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →