CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17784Commits captured
17252AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17252 analyses
Highest risk·RSS
Informational 13 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Test a locked wallet rejects an empty importdescriptors request

This commit only adds new test code to Bitcoin Core. It checks that a locked wallet refuses an empty importdescriptors request, and that an unlocked wallet accepts one. There is no change to production wallet logic, so it does not fix or i…

No production code changedAdds regression test for locked-wallet RPC behaviorError message references wallet passphrase requirement
07fb58b9by Pol Espinasa+9−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: clean up serde-as-consensus docs

This commit only updates documentation comments and adds code examples for two Rust modules. No program logic, behavior, or security-sensitive code was changed. It is a documentation-only cleanup.

dbfe0e3fby Nick Johnson+74−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

build: build-docker.sh: also copy out artifacts from pub/

This is a build-script fix that ensures additional firmware artifacts from a 'pub/' directory are copied into the build output. It also fixes a typo in an error message. There is no indication this changes runtime behavior, cryptographic c…

029217deby Martin Milata+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/build): include btconly in pub/ firmware filename

This commit fixes a build-script naming issue. When building a Bitcoin-only version of the Trezor firmware, the output filename in the published artifacts folder now includes 'btconly' so it is not confused with the regular firmware file. …

9653124dby Martin Milata+17−23 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/build): copy secmon to artifacts/pub

This is a small build-script fix that changes which compiled files get copied into a public artifacts folder. Previously, both the 'Kernel' and 'Secmon' projects were excluded from being copied. Now, only the 'Kernel' project is excluded, …

No security-relevant keywords in commit title or messageNo changelog entry providedChange is limited to build artifact copying logic
59923d50by Martin Milata+3−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

build: build-docker.sh: copy kernel.{elf,map} to build output

This change updates a build script so that when compiling Trezor firmware inside Docker, the kernel's ELF debug file and map file are compressed and copied to the build output directory. It is a build/CI convenience fix, not a code change …

51a09aa3by Martin Milata+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

index: shrink txospenderindex value markers

This is a minor storage optimization for a Bitcoin Core index. It changes the on-disk value stored alongside each index entry from an empty string to a zero-byte value, saving one byte per entry when the index is rebuilt. The lookup logic …

ce068782by Lőrinc+6−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: add txospenderindex release note

This commit only adds a release note explaining that a new index format uses slightly less disk space. It is documentation only and contains no code changes that could affect security.

11340228by Lőrinc+9−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test kernel: Don't log on warnings change

This commit removes two logging-only functions from a Bitcoin Core test file. The functions only printed messages to the console when kernel warnings were set or unset during tests. Their removal does not change any production code, networ…

a99148d5by sedited+0−101 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bb03 ui: navigation icon buttons (Back/Next/Confirm/Cancel)

This commit is a user-interface redesign for the BitBox03 hardware wallet: text buttons like 'Yes/No' and 'Back/Next' are replaced with icon buttons. It also adds a hidden demo screen that can only be opened in the simulator by setting the…

UI code that renders security-critical approval/rejection actions was modifiedNew PNG assets are decoded and embedded; malformed assets could affect runtime behaviour, though they are compile-time constantsSimulator-only demo entry point is gated by a feature flag and a sentinel string, reducing production exposure
facb1e73by Jad+524−16619 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

kernel: Generate a signet with a challenge

This commit adds a new public API to Bitcoin Core's libbitcoinkernel that lets callers create a custom 'signet' network with their own challenge script. Signet is a test network where blocks must be signed by a known key. The change only e…

5b4fd284by sedited+34−14 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 85 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

wallet.check_sighash: don't assume tx.add_info_from_wallet alrdy ran

This commit fixes a defensive check in the Electrum Bitcoin wallet. Before signing a transaction, Electrum checks whether the transaction uses unusual 'sighash' flags that could allow someone else to move coins unexpectedly. The bug was th…

Sighash sanity check could be bypassed for beyond-gap-limit wallet inputsFix adds defensive deep-copy and wallet-info population inside check_sighashRegression test demonstrates dangerous sighash is now caught even with gap_limit=2
b57327fbby SomberNight+48−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →