Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

24Projects watched
17782Commits captured
17251AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17251 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Remove FreeBSD-specific workaround

This is a cleanup change that removes a temporary compatibility fix for newer FreeBSD versions. The workaround was only needed because of a bug in FreeBSD's system headers, and that bug has now been fixed in supported FreeBSD releases. The…

91b5c8a0by Hennadii Stepanov+0−21 file
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Clarify supported *BSD releases

This commit only updates three documentation files to clarify which versions of FreeBSD, NetBSD, and OpenBSD Bitcoin Core supports. No code was changed, and there is no security issue.

56701ff6by Hennadii Stepanov+6−63 files
No security note in commit
Informational 16 AI analysisMessage 81 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

android build: build p4a recipes with --no-isolation

This commit updates the Android build system for the Electrum Bitcoin wallet. It changes which version of a build tool (python-for-android) is used and adjusts the exact pinned versions of helper Python packages used during the build. The …

Build dependency pinning with SHA-256 hashes (HashPinnedDependency) improves supply-chain reproducibilityP4A version bump to a newer commit on the electrum_202602 branchNo runtime application code changed
6c5b7bf9by SomberNight+34−46 files
No security note in commit
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Drop unneeded `<sys/types.h>` include before `<ifaddrs.h>`

This commit simply removes an unnecessary C system header include (`<sys/types.h>`) from two files that already include `<ifaddrs.h>`. It is a code cleanup with no functional change and no security relevance.

22c328d3by Hennadii Stepanov+0−22 files
No security note in commit
Informational 20 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

release notes: mention increased min android version

This commit only updates release notes and documentation to state that Electrum's Android app now requires Android 8.0 instead of Android 6.0. There are no code changes, no bug fixes, and no security patches in the diff.

f985656dby SomberNight+2−12 files
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: add release notes

This commit only updates release note wording for a previous feature change. It does not modify any executable code, network behavior, or data handling. There is no security issue here.

6d0ea4cfby Andrew Toth+4−51 file
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

txospenderindex: disable bloom filters to optimize disk usage

This change is a straightforward performance and disk-space optimization. It adds an option to disable LevelDB bloom filters for database instances that only scan through data with iterators, because bloom filters only help when looking up…

a2b1c869by Andrew Toth+10−66 files
No security note in commit
Informational 12 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

update beryx jlink plugin to v4.0.2

This commit updates a build tool (the Beryx JLink plugin) from version 3.2.1 to 4.0.2 and adjusts the build script syntax to match the new plugin version. It also slightly reorganizes how native library paths are referenced. There is no di…

Dependency/plugin version bump (beryx jlink 3.2.1 -> 4.0.2)Build script API migration only; no application logic changedNo mention of CVE, security fix, or vulnerability in commit message or diff
f7f6b59dby Craig Raw+13−121 file
No security note in commit
Low 27 AI analysisMessage 35 · Opaque
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

followup for external classes

This commit adds custom JSON serializers for two new types of silent-payment address classes and blocks Gson from using Java reflection on any class outside the Sparrow project. The change is defensive: it makes tests fail in the same way …

Adds reflection-access filter to block reflective deserialization of external classesAdds custom Gson serializers/deserializers for silent payment address classesComments explicitly describe intent to make tests fail like production to ensure serializers are registered
771f2dc9by Craig Raw+38−01 file
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: update API text files

This commit only updates three generated API snapshot text files so that the documented type aliases for HkdfSha256 and HkdfSha512 point to HashEngine instead of Hash. These are documentation/snapshot files used to track the public API sur…

50654cc4by jrakibi+6−63 files
No security note in commit
Informational 19 AI analysisMessage 76 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: fix unusable HKDF alias

This commit fixes two broken type aliases (shortcut names) for HKDF, a cryptographic key-derivation helper, in the rust-bitcoin hashes library. The aliases were pointing at the wrong underlying type after a previous refactor, so any code t…

Cryptographic API type alias mismatch causing compile-time breakageNo runtime memory-safety or cryptographic flaw in the diff itselfFixes usability of HKDF-SHA-256 and HKDF-SHA-512 public aliases
04ae6494by jrakibi+4−41 file
No security note in commit
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this