Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

24Projects watched
17782Commits captured
17251AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17251 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: update offline-signing-tutorial to use exportwatchonlywallet rpc

This is a documentation-only update to the Bitcoin Core offline-signing tutorial. It replaces instructions that used manual descriptor export/import with instructions that use a newer built-in RPC command (exportwatchonlywallet / restorewa…

a15bdc05by Pol Espinasa+9−511 file
No security note in commit
Informational 13 AI analysisMessage 60 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ln/test: add tests for mpp accumulation of trampoline forwards

This commit only adds new unit tests for an existing trampoline forwarding feature in a Lightning network implementation. It does not change production behavior, fix a bug, or alter security logic. The tests exercise validation rules that …

b90152b0by Carla Kirk-Cohen+235−13 files
No security note in commit
Informational 15 AI analysisMessage 55 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ln/test: add test coverage for MPP trampoline

This commit only adds new test code for multi-path trampoline payments in the Lightning Dev Kit. It does not change any production logic, so it cannot introduce a security vulnerability on its own.

b975ff31by Carla Kirk-Cohen+277−41 file
No security note in commit
Informational 15 AI analysisMessage 75 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ln/tests: return BlindedPaymentPath from trampoline helper

This commit is a test-only refactor. It changes a helper function used in Lightning Dev Kit's internal tests so that it returns both a blinded payment tail and the full blinded payment path. This lets tests register the path in payment par…

19eefdefby Carla Kirk-Cohen+43−302 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): sync Crowdin translations

This commit is a routine update of translated user-interface text for Trezor hardware wallets. It changes wording in Czech, German, Spanish, French, and Portuguese translation files, plus the translation signature metadata. There is no cod…

700ef9acby Thalarion+404−3496 files
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): sync Crowdin update translations

This commit only updates translated text strings in the Trezor firmware. It changes wording in Czech, German, Spanish, French, and Portuguese translation files, plus the translation signature metadata. There are no code changes, no securit…

7aac81d8by Michal Kazda+37−526 files
No security note in commit
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): sync Crowdin fixing French failing tests

This commit updates translation files for Czech and French, plus the corresponding signed metadata. It changes wording on device screens (for example, how a 'hold to confirm' button is labeled and how a backup-fragment title is formatted) …

1c84fecaby Michal Kazda+6−113 files
No security note in commit
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): sync Crowdin fixing more French failing tests

This commit updates French translation strings in the Trezor firmware and refreshes the corresponding translation signature metadata. The changes are purely cosmetic wording adjustments for on-screen text (for example, changing one French …

13b41359by Michal Kazda+5−52 files
No security note in commit
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): update fixtures

This commit only updates expected test result hashes (called 'fixtures') in a single test data file. It does not change any firmware, application, or security code. There is no indication of a security fix or vulnerability.

f8d3ebf1by Michal Kazda+4241−42411 file
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Move listdescriptors retrieving from RPC to CWallet

This commit is a straightforward internal code cleanup: it moves the logic for listing wallet descriptors from the RPC command code into a reusable wallet helper function. There is no user-facing behavior change, no bug fix, and no securit…

f9273f01by Ava Chow+78−315 files
No security note in commit
Low 32 AI analysisMessage 65 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Write new descriptor's cache in AddWalletDescriptor

This change fixes a wallet bug where a newly added descriptor's pre-existing cache was kept in memory but never saved to disk. If the cache is lost, the wallet may need to rescan the blockchain to recover key derivation data, causing delay…

Data-loss / durability bug: in-memory cache not persistedWallet descriptor cache omission could affect key/address derivation stateNo input validation, cryptographic, or network attack surface visible in diff
a1c83789by Ava Chow+6−01 file
No security note in commit
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this