CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16818Commits captured
7068AI analyses
59High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

7068 analyses
Highest risk·RSS
High 72 AI analysisMessage 55 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

verify fetched transactions match requested txid

This commit adds checks to make sure that when Sparrow Wallet asks an Electrum server for a specific Bitcoin transaction, the server actually returns the transaction that was requested. Before this change, a malicious or buggy server could…

Missing input validation on server-provided transaction dataPotential transaction substitution by malicious or compromised Electrum serverDefense-in-depth verification added at data deserialization boundary
3979694eby Craig Raw+100−163 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 96 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

qml: strip whitespace from message before signing, as in qt gui

This commit fixes a minor consistency bug in Electrum's newer QML (mobile-style) user interface. When signing a message, the app now removes accidental spaces at the start or end of the message and address, just like the older desktop Qt i…

Behavioral inconsistency between GUI implementations could cause user confusion or failed verificationNo cryptographic weakness introduced; change is input normalizationNo memory-unsafe code, no privilege changes, no network changes
72507328by Ferdinando Ametrano+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: Rework rpc fuzz target

This commit rewrites an internal fuzz-testing harness for Bitcoin Core's RPC interface. It changes how fake RPC arguments are generated so the test can feed more realistic JSON data (numbers, booleans, nested arrays/objects, raw JSON) dire…

No changes to runtime consensus, networking, wallet, or RPC server logicOnly src/test/fuzz/rpc.cpp is modifiedChange improves fuzzer fidelity by removing RPCConvertValues string-to-JSON conversion
fa895bb7by MarcoFalke+64−481 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

cautions, edit

This commit is a minor formatting edit to the README.md file. It changes a 'Security Advisory' heading from being displayed as a code block (with diff-style coloring) to a normal Markdown heading, and adds a horizontal rule. There are no c…

c849c4e0by Peter D. Gray+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Critical 100 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

cautions

This commit adds a security advisory to the COLDCARD firmware README. Coinkite states that firmware releases from 2021 through July 2026 contained a bug that produced weak randomness (poor entropy) when generating secrets such as wallet se…

Vendor self-disclosed security advisory in project READMEWeak/poor entropy in cryptographic secret generationAffected period spans multiple years (2021 to July 2026)
266f581aby Peter D. Gray+18−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 40 · Thin
KX KruxKrux BitcoinHardware wallets

chore(Maixpy): bump cUR

This commit appears to be a routine version bump of a component called 'cUR' inside the MaixPy firmware build. No actual code changes are visible in the provided diff, and the commit message gives no indication of a security fix or vulnera…

74d6ed40by odudex+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 18 · Opaque
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

upgrade protobuf

This commit relaxes the version requirement for the 'protobuf' Python library in the project's dependency files. It changes the requirement from 'exactly 4.23.3 or compatible updates' to 'any version 4.23.3 or newer'. This is a routine dep…

Dependency version constraint relaxed to allow newer protobuf versionsNo source code changes or vulnerability-specific patch evidenceNo CVE, advisory, or security-related references in commit or supplied materials
a7367506by andreasgriffin+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 28 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

u2f: fix refresh screen

This commit fixes a UI cleanup bug in the BitBox02 hardware wallet's U2F (Universal 2nd Factor) feature. Previously, a 'Refresh webpage' screen could be destroyed without clearing the pointer that tracked it, potentially leaving a dangling…

dangling-pointer mitigationuse-after-free preventionfirmware UI state cleanup
890f4ce3by benma's agent+17−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: register embed_fire in the bdftokff device list

This commit fixes a build-time font-generation script so that a newly supported device ('embed_fire') is recognized. Before the fix, the script printed an error but still produced the same font files. There is no security issue.

f15308e4by odudex+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 2 AI analysisMessage 57 · Thin
KX KruxKrux BitcoinHardware wallets

chore: bump MaixPy with updated glyphs

This commit appears to update a submodule or dependency called MaixPy to a newer version that includes updated visual glyphs (small icons/symbols). The title and message describe it as a routine maintenance chore, not a security fix. No ac…

a9329228by odudex+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 57 · Thin
KX KruxKrux BitcoinHardware wallets

docs: add PSBT input amount fixes to CHANGELOG

This commit only updates the project's CHANGELOG.md to document earlier fixes related to PSBT (Partially Signed Bitcoin Transaction) fee and amount handling. It does not contain any code changes itself. The changelog entries describe secur…

Changelog documents prior PSBT fee/amount validation fixesMentions insufficient coordinator data as a security concernNo actual code or test changes in this commit
48920c31by odudex+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 78 AI analysisMessage 95 · Strong
KX KruxKrux BitcoinHardware wallets

fix: verify PSBT input amounts before showing the fee

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify …

Fixes fee-display/sighash amount mismatchAdds prevout txid hash verification for non_witness_utxoMandates non_witness_utxo for legacy inputs
fc808059by odudex+353−122 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →