Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

24Projects watched
17782Commits captured
17251AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17251 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

chanstate: make store channel types generic

This commit is a pure internal code reorganization. It moves several small channel-related data types (like channel configuration, status flags, close summaries, and helper types) from the channeldb package into a new chanstate package, th…

f53d615cby ziggie+473−36518 files
No security note in commit
Informational 19 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

cln-plugin: include the full error chain when given a context

This commit improves error messages in Core Lightning's Rust plugin library. When a plugin method fails and the error has extra context attached (using the popular Rust 'anyhow' error library), the plugin now returns the full chain of erro…

No security-relevant signals detected in the diff or commit message.Change is purely error-message formatting/diagnostics in Rust plugin framework.No input validation, memory safety, authentication, or authorization changes.
d94b37b8by daywalker90+44−83 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

lsps-plugin: print whole error chain for HtlcError

This commit changes three error-message format strings in the LSPS (Lightning Service Provider Specification) plugin so that when an HTLC-related error occurs, the entire chain of underlying causes is printed instead of just the top-level …

17abce24by daywalker90+3−31 file
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

pytests: fix flakyness on test_no_delay: introduced statistical margin instead of fixed amount to reduce flakiness

This commit only changes a single test file to make a flaky timing test more reliable. It does not modify any production code, network protocol handling, or user-facing behavior. There is no security issue here.

50942584by ScuttoZ+49−361 file
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: archive release notes for v31.1

This commit simply archives the release notes for Bitcoin Core version 31.1. It adds a documentation file summarizing what changed in that release, but does not change any program code. There is no direct security risk from this documentat…

2b6e767dby fanquake+140−01 file
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

ci: reduce sanitizer/valgrind worker count to avoid runner OOM

This change only adjusts the project's automated testing setup. It reduces the number of parallel test workers in two CI jobs to stop GitHub's hosted test machines from running out of memory, and adds logging to confirm the cause if they s…

0da8fa28by Níckolas Goline+16−21 file
No security note in commit
Informational 19 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

p2p: Don't participate in addr relay with feeler connections

This change is a small network-efficiency cleanup, not a security fix. Bitcoin Core's 'feeler' connections are brief probes used to check whether another node is online. Previously, the software would ask feeler peers for addresses (sendin…

No security-relevant signal: change is described by the project as a bandwidth optimizationNo memory safety, cryptographic, consensus, or authorization changeNo bug class such as DoS, eclipse-attack vector, or information leak is introduced or fixed
b0735336by Daniela Brozzoni+12−22 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: add bitcoin_hashes and bitcoin-network-kind to SEMVER_HARD_FAIL_CRATES

This commit only changes a CI script that lists which Rust crates must follow strict semantic-versioning rules. It adds two already-released 1.0 crates to the hard-fail list so future pull requests will fail automated checks if they accide…

30d8c6c6by jrakibi+1−11 file
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: Scan bitcoin-network-kind for semver breaks

This commit only adds a new Rust package (bitcoin-network-kind) to an existing CI script that checks for accidental breaking changes in public APIs. It does not change any library code, runtime behavior, or security-sensitive logic. There …

f4efe62aby jrakibi+13−01 file
No security note in commit
Informational 17 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

refactor(offers): extract payer key derivation helpers

This commit is a code cleanup (refactor) in the Lightning Dev Kit library. It moves existing payer key-derivation logic into shared helper functions so that future 'payer proof' features can reuse the same code. The change does not appear …

Refactor only: moves existing key derivation/verification logic into helpers without changing algorithmsAdds new public API `Bolt12Invoice::derive_payer_signing_keys` for payer proof key recoveryNo mention of vulnerability, bug, CVE, security fix, or exploit in commit title/message
2bd9266aby Vincenzo Palazzo+120−212 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

offers: add merkle selective-disclosure primitives

This commit adds new code to support BOLT 12 "selective disclosure" payer proofs in the Lightning Dev Kit. It lets someone prove they have a valid signed invoice without revealing every field. The change is a feature addition, not a fix fo…

New cryptographic merkle-tree code for BOLT 12 payer proofsRefactors existing TLV hashing to share primitives between signing and selective disclosureAdds omitted-marker validation to prevent non-minimized or out-of-order marker sequences
da6e0bb5by Vincenzo Palazzo+852−183 files
No security note in commit
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this