CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17784Commits captured
17252AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17252 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

validation: add -prevoutfetchthreads configuration option

This commit adds a new user-configurable setting called -prevoutfetchthreads that controls how many background worker threads Bitcoin Core uses to fetch previous transaction outputs (prevouts) from the UTXO database while connecting a new …

5bf1c320by Andrew Toth+21−06 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

coins: introduce thread pool in CoinsViewOverlay

This Bitcoin Core change adds a shared worker thread pool to a new internal caching layer called CoinsViewOverlay. It is not a security fix for users; it is mostly a performance and test-stability improvement. The commit message notes that…

Memory-leak mitigation in fuzzing harnesses only (developer/test tooling)New shared ThreadPool lifecycle management in CoinsViewOverlayNew command-line option -prevoutfetchthreads controlling worker thread count
f82043afby Andrew Toth+75−1510 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Make test less flaky

This commit removes Bootstrap tooltip attributes from a few disabled buttons and archive links in the invoice view. It is a test-flakiness fix with no apparent security relevance.

7cb03bb3by Nicolas Dorier+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

bitcoin-util: Add netmagic command

This commit adds a new command-line utility feature to Bitcoin Core. The `bitcoin-util netmagic` command simply prints the network magic bytes (a public identifier for which Bitcoin network is being used, such as mainnet or testnet). It do…

a318f432by ekzyis+75−09 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

validation: In AcceptBlock, ignore flush result

This change fixes a subtle bug in how Bitcoin Core reports disk flush errors during block acceptance. Previously, if writing block data to disk failed (for example, because the disk was full during pruning), the error could be misreported …

Error-state confusion between disk flush and block validationPotential for valid blocks to be rejected due to misattributed flush failuresDefensive hardening of error propagation in consensus-critical code path
256482abby optout+8−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LL Lightning LabsLND BitcoinLightning Network

scripts/keys: add pub key for gijswijs

This commit simply adds a new PGP public key for a person named 'gijswijs' to the list of keys used by LND's release verification script. It does not change any code that handles money, network connections, or cryptography beyond registeri…

74102ae6by Gijs van Dam+52−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Tweak default merge message somewhat

This commit adds a template file that controls the default message shown when merging pull requests on a Forgejo code hosting instance. It only changes the formatting of merge commit messages and has no security relevance.

693c478aby Matt Corallo+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Explicitly state rust toolchain in forgejo actions

This commit is a cosmetic cleanup of CI workflow files. It replaces environment variables like TOOLCHAIN with the literal Rust version names (e.g., 'stable', 'beta', '1.75') in step titles and commands so that Forgejo's CI logs display mea…

05c9ef04by Matt Corallo+23−413 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tron): scaffolding for `WithdrawBalanceContract`

This commit adds support for a new Tron blockchain operation called 'WithdrawBalanceContract' (claiming voting rewards). It is a feature addition: new message types, generated code, translations, and a test fixture. There is no indication …

2b93024eby PrisionMike+481−5118 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(tron): add support for `WithdrawBalanceContract`

This commit adds support for a new Tron blockchain transaction type called WithdrawBalanceContract, which lets users claim their voting rewards. It also improves the on-device confirmation flow for claim transactions so the device warns an…

New contract type added to allowed list (CONTRACT_TYPES) and name map (CONTRACT_TYPE_NAMES)Owner-address mismatch now triggers an explicit warning screen before signingNo new parsing of untrusted lengths or memory allocations beyond existing protobuf helpers
c687e153by PrisionMike+432−3713 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tron): use pubhash for address derivation.

This commit changes how Trezor hardware wallets derive TRON addresses. Previously, the code loaded the private key into Python memory and computed the public key from it. Now it uses a precomputed public-key hash already available from the…

Reduction of private-key exposure in application-layer Python codeRemoval of secp256k1.publickey() derivation from private key in get_address flowUse of node.ethereum_pubkeyhash() for address derivation
4b204ec9by PrisionMike+9−123 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 68 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fix lightning-invoice bitcoin dependency version

This commit is a routine packaging fix. It updates the minimum required version of the rust-bitcoin library for the lightning-invoice crate from 0.32.4 to 0.32.7 because the code no longer compiles against older 0.32.x releases. It does no…

fbc22051by Daniel Roberts+1−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →