CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17782Commits captured
17251AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17251 analyses
Highest risk·RSS
Low 32 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

offers: add BOLT 12 payer proof primitives

This commit adds a new feature to rust-lightning called BOLT 12 payer proofs. It lets someone who paid a BOLT 12 invoice cryptographically prove they paid it, while optionally hiding some invoice details. The change is a large new module p…

New cryptographic proof-of-payment feature, not a vulnerability fixExtensive parse-time validation: preimage hash match, issuer signature, payer signature, TLV ordering, duplicate rejection, omitted-marker minimizationSelective disclosure logic relies on merkle tree reconstruction; correctness is backed by spec test vectors
5747866aby Vincenzo Palazzo+2631−126 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ln: persist the paid BOLT 12 invoice and build payer proofs

This commit is a feature addition, not a vulnerability fix. It extends rust-lightning's BOLT 12 payment support so that when a wallet pays a BOLT 12 invoice, the paid invoice is saved through retries and restarts and is later exposed in th…

New BOLT 12 payer proof feature: persists paid invoice across retries/restarts and exposes it in Event::PaymentSentPayer signing key re-derived from invoice payer metadata rather than storing extra key materialAdds end-to-end test for proof creation, verification, and bech32 round-trip
580c9bc8by Vincenzo Palazzo+226−284 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

fuzz: add a payer proof deserialization target

This commit only adds a new fuzz test target. Fuzz tests are automated tools that throw random or crafted input at a piece of code to look for crashes or bugs. The commit does not change any production code, protocol behavior, or user-faci…

1817d621by Vincenzo Palazzo+171−05 files
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

init: wake genesis wait after ImportBlocks() returns

This commit fixes a bug where Bitcoin Core could hang during shutdown if the user started a 'reindex' and then asked the program to quit before it finished loading the very first block. The fix adds a notification so the shutdown request i…

Denial-of-service/availability issue: graceful shutdown can hangFix is in initialization/shutdown synchronization logicNo attacker-controlled input path identified
c1313b19by ismaelsadeeq+14−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 97 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use `NetworkErrorString` for macOS code in `netif.cpp`

This is a minor code cleanup in Bitcoin Core. It swaps one internal error-message helper for another that produces the exact same text on macOS and Linux, and removes an unused header include. There is no functional change and no security …

eccb04a3by Hennadii Stepanov+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 68 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

descriptor: avoid iterating multisig nodes twice

This is a small code cleanup in how a Bitcoin descriptor function counts child nodes. It removes a redundant loop and counts children while already checking them. There is no visible security bug being fixed—just an efficiency and clarity …

017d76ebby Jon Griffiths+9−101 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Adjust Script::witness_version doccomment

This commit only changes a documentation comment for a Rust function. It removes the phrase 'assuming the script is a scriptPubkey' because the code's type system now guarantees the script type. No code behavior was altered, so there is no…

73f19ddfby Mitchell Bagot+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): fix typo in license headers

This commit fixes a spelling mistake in the legal license text at the top of six source files. The typo 'HMAC_SHALL' is corrected to 'SHALL'. It does not change any program logic, security behavior, or compiled code.

814dcf35by M1nd3r+6−66 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine patch-version update of a GitHub-maintained security scanning helper (the CodeQL upload-sarif action) inside a CI workflow. It does not change the project's actual Bitcoin library code, its public interfaces, or how user …

29bb6aa2by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/checkout from 5.0.0 to 6.0.2

This is a routine automated update by Dependabot that changes the version of the GitHub Actions 'checkout' tool used by the project's CI workflows from version 5.0.0 to version 6.0.2. It only affects how the repository code is downloaded d…

14a75c38by dependabot[bot]+32−3216 files
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump ncipollo/release-action from 1.20.0 to 1.21.0

This is a routine update by Dependabot to the GitHub Action used for creating releases. It changes the pinned version of ncipollo/release-action from 1.20.0 to 1.21.0 in the project's release workflow. There is no direct evidence in the co…

Dependency bump of a third-party GitHub Action used in release automationNo security-relevant description in commit message or titleNo CVE, advisory, or security release notes referenced
5c75b6daby dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 7.1.2 to 8.1.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install the 'uv' Python tool in two workflow files. The new version is a major release of the setup-uv action, but the commit itsel…

fab2fabbby dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →