CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17784Commits captured
17252AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17252 analyses
Highest risk·RSS
Informational 19 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): identify a tokenAmount token by a constant address

This commit adds a new optional field to Trezor's Ethereum clear-signing protocol that lets a token amount be tied to a fixed contract address rather than pulled from transaction data. It is a feature addition, not a bug fix, and there is …

New optional protobuf field for token address resolutionToken address now accepted as literal constant without visible length/format validationNo changelog entry provided
c5aa2851by PrisionMike+83−65 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): support multi-value (array) fields

This commit adds support in Trezor's Ethereum 'clear signing' feature for displaying array (multi-value) fields on the device screen. It also fixes a minor display quirk where booleans were being treated as numbers. There is no direct evid…

Broadened path-walker return type and removed 'must not arrive at Array/Tuple' guard, which could change error-handling behavior for malformed field definitions.Added explicit boolean handling in RawFormatter to avoid incorrect rendering under MicroPython.New helper raises `InvalidFormatDefinition` if any array element formats to `None`, which is a defensive consistency check.
f9f6eb97by PrisionMike+56−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(clear_signing): add Trezor Test descriptor and clear-signing tests

This commit only adds test code for Trezor's Ethereum clear-signing feature. It introduces debug-only test descriptors, unit tests, device tests, and expected screen snapshots. There is no change to production behavior or any fix for a sec…

c11f7477by PrisionMike+961−16 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: introduce NodeSigner, run feature_taproot.py without wallet compiled

This commit only changes Bitcoin Core's internal functional test code. It introduces a small test helper class called NodeSigner so that one specific test (feature_taproot.py) can run even when Bitcoin Core is compiled without its built-in…

91586f70by Sebastian Falbesoner+49−142 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): reduce ui-report action's verbosity

This commit simply removes the '-v' (verbose) flag from several file copy and move commands in a GitHub Actions workflow. It only affects how much log output is produced during CI test reporting and does not change what files are moved, co…

de911a7eby Roman Zeyde+5−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): use s5cmd for UI fixtures upload

This commit changes how the project uploads automated test screenshots and recordings to Amazon S3. It switches from the standard AWS command-line tool to a faster third-party tool called s5cmd, and updates the AWS region from Ireland (eu-…

62db3706by Roman Zeyde+9−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 84 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): parallelize UI artifacts' generation

This commit is a harmless internal CI tooling change. It speeds up a test-artifact packaging script by using multiple parallel workers and removes duplicate ZIP files that could overwrite each other. There is no user-facing or security-rel…

33965624by Roman Zeyde+29−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 47 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor: remove DerivationError

This commit removes a deprecated type alias named `DerivationError` from the public API, replacing it with the already-existing `DeriveXpubError`. It is a straightforward cleanup with no functional code changes and no security implications.

72954d3aby Trevor Arjeski+0−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

refactor: split bip32 xkey parse errors

This commit is a code cleanup: it splits one big error type into several smaller, more specific error types for BIP-32 extended key parsing. It does not change what the code accepts or rejects, only how errors are named and organized. Ther…

55ef86a2by Trevor Arjeski+214−771 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

style: reorder bip32 error impls

This commit is a pure code-style change. It reorders the implementation blocks for several error types in a Bitcoin-related Rust library so that the order of traits (From, std::error::Error, Display, helper methods) is consistent. No logic…

78a3ac3fby Trevor Arjeski+38−381 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: return full keypair from `getnewdestination` helper

This is a small test-only code cleanup. A helper function used only in Bitcoin Core's functional test suite now returns the full private/public key pair instead of just the public key, so that future tests can spend coins sent to a generat…

771200caby Sebastian Falbesoner+6−63 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: listpays: test grouping by calling xpay

This commit changes a single line in a test file, switching a test from using the older `pay` RPC command to the newer `xpay` RPC command. It is purely a test/quality change and does not modify any production code, fix a bug, or address a …

c17a48faby Lagrang3+1−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →