CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16815Commits captured
6317AI analyses
58High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

6317 analyses
Highest risk·RSS
Critical 90 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

edits

This commit is only a wording edit to the COLDCARD firmware changelog, but the changelog text itself discloses a serious security problem: some COLDCARD devices generated wallet seeds with far less randomness than intended. Mk3 devices run…

Vendor self-disclosed 'urgent hotfix to correct a limited entropy bug'Cryptographic randomness/entropy reduction in seed generationAdvisory tells users to regenerate seeds and use newer hardware or BIP-39 passphrase
d9be4503by Peter D. Gray+8−81 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

better bumpage

This commit only changes version numbers in the changelog and two build makefiles. It does not modify any code, fix any bug, or alter any behavior. The actual security-relevant fix for the 'limited entropy bug' is not present in this diff.

ee36d35aby Peter D. Gray+3−33 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a hardcoded Bitcoin block height number in a firmware file, moving it forward by two blocks. There is no code change that affects security, user funds, or device behavior beyond reflecting a slightly later point …

6691ba63by Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

nit

This commit only removes a period at the end of one changelog sentence. It is a trivial punctuation/typography fix with no code or security behavior change.

4ba45bc9by Peter D. Gray+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: decoder docs which are consensus specific

This commit only changes documentation comments in the consensus_encoding crate. It renames descriptions like 'Primitive decoders' to 'Primitive and combinator decoder types' and updates several function doc comments to say 'consensus deco…

5cdd5aa0by Nick Johnson+11−132 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add sha256::Midstate::SHA256_IV constant

This commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than al…

dc21841bby Andrew Poelstra+39−143 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add several methods to sha256::Midstate for computing them in const contexts

This commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature …

7d8f06d2by Andrew Poelstra+80−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: update API files

This commit only updates three text files that list the public API surface of the `bitcoin_hashes` crate. It adds entries for newly exposed SHA-256 midstate methods and a constant. There is no code change, no bug fix, and no security-relat…

44552e3aby Andrew Poelstra+12−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates machine-generated API snapshot text files to add a newly exposed public function, CompactTarget::to_target, to the recorded public interface. There is no source code change, no bug fix, and no security-relevant beh…

cebefd5cby Mitchell Bagot+6−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

crypto: add ec_public_key_compress to produce a compressed pubkey

This commit adds a new public-key compression function to a cryptographic library and updates the existing decompression function so both can accept already-compressed or already-uncompressed keys as input. It also adds tests and language …

03351cc9by Jon Griffiths+92−1610 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 55 · Thin
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

tests: add tests for parsing invalid der sigs

This commit only adds new test cases to check that the library correctly rejects malformed cryptographic signatures. It does not change any production code, so by itself it cannot introduce or fix a security vulnerability. It may be relate…

DER signature parsing validation is being exercisedTest vectors include R/S overflow and zero R/S casesNo functional code change in this commit
824e8a33by Jon Griffiths+11−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 85 · Strong
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

sign: disallow overlong der encodings and zero r or s values

This commit tightens signature validation in a cryptographic library. It now rejects malformed DER-encoded signatures that are longer than allowed, or where one of the signature numbers (R or S) is zero. Previously, the underlying secp256k…

Cryptographic input validation hardeningRejection of overlong DER-encoded ECDSA signaturesRejection of zero R or S signature components
e7894ee6by Jon Griffiths+6−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →