CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17784Commits captured
17252AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17252 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 87 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core): drop `test_descriptor_all_formatters` unit test

This commit simply removes a single unit test from the Trezor firmware test suite. The test covered Ethereum 'clear signing' formatting logic, and the commit message says it is being dropped because it should be covered by device tests ins…

3704e769by Roman Zeyde+0−1411 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

fuzz: add explicit local force-close ops

This commit only changes a fuzzing test harness (chanmon_consistency.rs). It adds new test operations that simulate local force-closing of channels and tracks which channels are expected to close so the harness can reject unexpected channe…

2ede7212by Joost Jager+341−811 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 76 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml/2fa: partially reverse #10543

This commit changes the Android two-factor authentication setup flow in Electrum's mobile app. Previously, tapping the QR code would open an external authenticator app directly, but on Android this caused Electrum to be killed by the syste…

No security-relevant code change: only UI interaction behavior for 2FA setupClipboard used as fallback for sharing OTP secretExternal URL opening disabled on Android due to OS lifecycle issue, not due to a security flaw in the URL handler
b5a0af27by f321x+11−71 file
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

rpc: reject null for optional parameters

This Bitcoin Core change tightens how three RPC commands—deriveaddresses, scanblocks, and scantxoutset—handle the JSON value null when it is passed for an optional parameter. Previously, passing null could be treated the same as not passin…

Null-value handling in RPC parameter parsingPotential null-pointer / invalid-array-access in scanblocks and scantxoutsetIncorrect error path for ranged descriptors in deriveaddresses when null range supplied
aeca0610by Ruslan Kasheparov+18−75 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): sync Crowdin translations

This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates wording in Czech, German, Spanish, French, and Portuguese translation files, plus the translation signat…

8c288b4aby Michal Kazda+682−3076 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): update fixtures [no changelog]

This commit only updates expected test result hashes (called 'fixtures') in a single test data file. It does not change any firmware source code, wallet logic, or user-facing behavior. There is no indication of a security fix or vulnerabil…

cf3136f6by Michal Kazda+937−9371 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

py: add BitBoxSync

This commit adds a new Python client feature called BitBoxSync to the BitBox02 Python library. It introduces generated protobuf code, new API methods to request identity keys, sign various sync-related intents, and unwrap an encrypted name…

851ed04bby Marko Bencun+574−1812 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 59 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

api: add BitBoxSync

This commit adds a brand-new firmware feature called BitBoxSync, which lets the BitBox02 hardware wallet participate in a sync service by proving its identity, signing login/admin intents, and decrypting namespace encryption keys. The code…

New cryptographic API surface added to the hardware wallet (Ed25519, X25519, HKDF, AEAD)Vendored third-party crate `hkdf` introduced into the firmware supply chainNew user-confirmation flow for signing sync intents; one operation (UnwrapNamespaceDek) deliberately skips confirmation
54cdb54dby Marko Bencun+2883−2230 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 53 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

Add Blockstream info and badge in README

This commit only updates the project's README file to add company information and a badge for Blockstream. It does not change any program code, configuration defaults, or security behavior.

0ff91675by ShahanaFarooqui+5−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

docs: update changelog

This commit only edits the project's changelog. It corrects the nicknames of two prior releases (changing Roman numeral III to II and II to I) and updates the pull-request reference numbers for a previously released fix about including roo…

e814cbb2by Madeline+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 95 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore(zcash): bump orchard to 0.15.0-pre.1, repoint librustzcash

This commit updates the Zcash cryptography libraries inside the Keystone hardware wallet firmware. The main functional change is a bug fix: when the wallet tries to read encrypted Zcash note details, it now correctly chooses the decryption…

Incorrect note-encryption domain selection could prevent decryption of Ironwood (V3) shielded outputsDependency bump to orchard 0.15.0-pre.1 introduces BundleVersion API and splits V2/V3 note encryption domainsTest fixtures corrected to avoid prohibited orchard_v3 coinbase bundles for V2 Orchard notes
242daed7by Adam Tucker+87−455 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 87 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): add date and raw formatters. - core tests added. - proto updated. [no changelog]

This commit adds two new ways to display Ethereum transaction details on a Trezor screen: a 'raw' formatter that shows values as-is (numbers, text, or hex bytes) and a 'date' formatter that turns a Unix timestamp into a readable date. It a…

New formatter code handles bytes/string/int conversions; potential for unexpected input typesDateFormatter only accepts int; other types raise InvalidFormatDefinitionRawFormatter raises InvalidFormatDefinition on unsupported types
600cf34eby PrisionMike+190−127 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →