CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17784Commits captured
17252AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17252 analyses
Highest risk·RSS
Informational 22 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core/prodtest): Add tropic-tests-cleanup.

This commit adds a new factory-test command called tropic-tests-cleanup to the Trezor device's production-test firmware. The command erases leftover test data from secure chip slots so a device is not accidentally shipped with stray data f…

New factory-only CLI command that erases test artifacts from secure-element slots before shippingBroadened counter reinitialization path in the change-PIN flow to handle a depleted counterNo mention of CVE, bug bounty, researcher credit, or advisory in commit or supplied references
dbe34907by Andrew Kozlik+178−255 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: use true|false over "true|false"

This commit is a minor cleanup in Bitcoin Core's continuous integration (CI) configuration. It changes the way some on/off settings are written in shell scripts from quoted strings like "true" and "false" to unquoted true and false. There …

47bbed05by fanquake+9−94 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: use a 8x instance over 16x

This commit simply changes one CI (continuous integration) job to use a smaller GitHub Actions runner size, from 16x to 8x. It is a cost or resource tuning change with no security relevance.

9a25bc39by fanquake+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 58 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Reduce LSPS5 reset cooldown

This commit shortens a rate-limiting cooldown in the LSPS5 webhook notification system from 10 seconds down to 100 milliseconds, and fixes a time-calculation bug that previously dropped sub-second precision. The change is described by the …

Rate-limit/amplification throttle weakened (10s -> 100ms)Time/duration arithmetic precision fixWebhook notification cooldown reset logic changed
773c08acby Elias Rohrer+18−113 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 82 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

CI: Check generated docs on Mac

This commit adds a single step to the project's Mac CI workflow that verifies generated documentation files are up to date. It is a build/test hygiene change with no security relevance.

066056d9by Dusty Daemon+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core/bolt): support two line button text

This commit adds the ability for buttons in the Trezor hardware wallet's user interface to display text across two lines when the text is too long to fit on one line. It is a UI layout improvement with no apparent security relevance.

39e0f0c1by obrusvit+19−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 84 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): use default cancel icon in SD card

This is a tiny user-interface tweak. It removes a custom 'Cancel' button label from an SD-card formatting confirmation screen so the text fits on one line in the Bolt layout. The button still exists; it just uses the device's default cance…

46717e08by obrusvit+0−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): update fixtures.json

This commit only updates the expected visual fingerprints (hashes) used by the project's automated user-interface tests. It does not change any firmware code, cryptographic logic, or behavior that end users interact with. There is no secur…

0d2d595fby obrusvit+128−1281 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace uses of encode_to_engine with encode_to_hash

This is a small internal code cleanup in the rust-bitcoin library. It replaces a slightly longer two-step hashing pattern with a shorter helper function that does the same thing. The actual cryptographic results and behavior are unchanged.

f40e1879by Mitchell Bagot+6−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates generated API snapshot text files in the rust-bitcoin repository. These files list what functions and types are publicly exposed by the library, similar to a table of contents. No actual source code, logic, or beha…

16ca3c27by Mitchell Bagot+6−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: Add drain_to_hash and encode_to_hash

This commit adds two new convenience functions to the rust-bitcoin hashes library. They are purely additive helper functions that wrap existing, safe hashing operations into a one-step call. There is no indication of any security bug, fix,…

0a15eb84by Mitchell Bagot+22−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

qetxfinalizer: regex doesn't cover all, invalid Decimal -> 0 in TxFeeSlider.userFeeRate setter.

This commit fixes a crash in Electrum's mobile/QML fee slider. When a user typed a fee rate that the input regex allowed but Python's Decimal parser rejected, the app would crash with an 'InvalidOperation' exception instead of gracefully f…

Unhandled exception in user-input parsing pathUI crash / denial-of-service via malformed fee-rate inputInput validation gap between regex and Decimal parser
11155fdfby Sander van Grieken+5−21 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →