CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17776Commits captured
17247AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17247 analyses
Highest risk·RSS
Low 42 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/ui): avoid signed overflow when calculating text width

This commit fixes a bug in how the Trezor hardware wallet calculates the width of on-screen text. Previously, very long text could cause an internal counter to overflow from a large positive number to a negative number, which might make te…

Signed integer overflow in UI text measurementUse of saturating arithmetic as defensive fixPotential UI/layout misbehavior from negative width values
7c429403by Martin Milata+6−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): loop.mailbox exception handling

This commit fixes how a low-level task mailbox in the Trezor firmware handles stored values. Previously, if another task placed an exception into the mailbox, the waiting task would receive that exception as if it were a normal value inste…

Exception value returned as normal result instead of being raisedScheduler/task mailbox semantics inconsistent with try/except pathPotential masking of error conditions in coroutine-based firmware
cbb5281bby Martin Milata+6−31 file
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(python): ignore packets with mismatched THP channel

This commit fixes the Trezor Python host library so it ignores USB packets whose channel ID does not match the current session. Previously, packets from other channels (or broadcast packets at the wrong time) could be accepted and processe…

Input validation added for channel identifier (CID)Cross-channel packet filteringBroadcast packet handling restricted to explicit allowlist
e20ea1b9by Martin Milata+16−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core): allow logging from rust unit tests

This commit only changes how Rust unit tests inside the Trezor firmware project can print diagnostic messages. It enables a debug console feature for test builds, reads an optional RUST_LOG environment variable, and increases the maximum l…

a9bc6e5aby Martin Milata+16−23 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(rust/trezor-thp): buffer size hint in PacketInResult::Route

This commit is a code cleanup in Trezor's Rust transport layer. It changes how incoming packets are inspected before being forwarded to the right channel, adding a buffer-size hint so the caller can allocate a large enough receive buffer. …

New buffer-size hint in routing result may prevent undersized receive buffersHost-side codec v1 packets are now explicitly ignored rather than routedPayload length bounds checks are centralized and applied earlier in routing
55270d31by Martin Milata+108−346 files
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(rust/trezor-thp): keep device_properties in Mux

This commit is a straightforward internal code refactor in Trezor's Rust firmware. It moves the storage of 'device_properties' from the credential verifier object into the communication multiplexer (Mux). The actual data being sent during …

ef4cb485by Martin Milata+31−303 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(rust/trezor-thp): keep track if channel finished pairing/credentials

This commit is a straightforward internal code refactor in the Trezor hardware wallet's Rust transport-handshake protocol (THP) library. It replaces a simple pairing-state field with a richer 'phase' enum that tracks whether the channel is…

Refactor only: no vulnerability patch, no bounds-check changes, no cryptographic algorithm changesAdds explicit lifecycle phase tracking to prevent callers from misidentifying the channel's setup stateDefault phase uses least-privileged `Unpaired` value as a defensive default
496f4b1bby Martin Milata+63−114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(rust/trezor-thp): export more constants

This commit is a straightforward internal code cleanup in the Rust implementation of Trezor's transport protocol (THP). It moves several constants from inside a trait or function to the module level and makes them public so other parts of …

8c9c1b1fby Martin Milata+13−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(rust/trezor-thp): crc32 vectors from test_trezor.wire.thp.checksum

This commit only adds more test cases and removes two unused helper functions for verifying CRC32 checksums. It does not change the actual CRC32 calculation logic, nor does it fix any security issue. There is nothing here that would allow …

fb53052dby Martin Milata+102−101 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(rust/trezor-thp): minor tweaks

This is a small internal code cleanup in the Trezor hardware wallet's Rust transport-handshake-pairing (THP) library. It moves a helper method (channel_id) into a shared trait, adds a read-only packet_len accessor, turns off noisy test log…

751b66fdby Martin Milata+36−146 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/rust): use ZeroizeOnDrop

This commit is a code cleanup in the Trezor firmware's Rust cryptography code. It replaces hand-written memory-clearing code with a standard library feature called ZeroizeOnDrop. The goal is the same: erase sensitive cryptographic data fro…

Use of zeroize/ZeroizeOnDrop for sensitive cryptographic materialRemoval of manual Drop implementations that zeroized buffersNo functional change to cryptographic operations or memory safety semantics
fdb58ef8by Martin Milata+26−377 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/rust): allow defining new micropython exceptions

This commit is a code cleanup in the Trezor firmware's Rust layer. It introduces a dedicated helper module for creating MicroPython exceptions and refactors existing error handling to use those helpers. There is no direct evidence in the c…

Refactor only: no vulnerability pattern is patchedNo changelog entry requested by authorAdds capability to define new MicroPython exception types, but no new exception is actually defined
cdb36b37by Martin Milata+104−385 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →