CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17784Commits captured
17252AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17252 analyses
Highest risk·RSS
Low 35 AI analysisMessage 65 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

payment_identifier: expand FIXME that openalias resolution DNS-leaks

This commit only adds comments to the code. It does not fix anything. The comments warn that when Electrum resolves OpenAlias or Lightning Address payment identifiers, it sends DNS queries directly to Google's DNS server (8.8.8.8) instead …

DNS queries bypass user-configured network proxyHardcoded external DNS resolver (8.8.8.8) receives query metadataPotential IP address leak for users relying on Tor/proxy for privacy
bb1aaf60by SomberNight+4−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

util: CallbackManager: add comment how unregister_callback could race

This commit only adds a comment explaining that a race condition is theoretically possible in the callback manager. It does not change any code behavior, fix a bug, or introduce a vulnerability. No action is needed beyond normal awareness.

cc525082by SomberNight+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace uses of bitcoin::consensus with consensus_encoding

This commit swaps out an older Bitcoin data-encoding system for a newer one across six files. It is a routine internal refactoring change. There is no direct evidence in the commit that it fixes a security vulnerability, but any encoding c…

Refactor of consensus-critical serialization code (sighash, taproot leaf hash, BIP-158 filters, consensus validation)Change of compact-size encoder/decoder implementation and error typesRemoval of `bitcoin::consensus` dependency from several modules
22cf8fb6by Mitchell Bagot+38−356 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace uses of consensus in tests

This commit only changes test code and documentation examples in the rust-bitcoin library. It replaces older consensus encoding/decoding helper functions with newer equivalents from a different internal module. There is no change to produc…

171f6661by Mitchell Bagot+81−697 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Replace use of con_serde in sighash test

This commit is a routine internal test refactor. It swaps one test-only helper for another so that a unit test can still decode hex transaction data after an older helper is removed. There is no change to production code or to how real tra…

09d0c9dfby Mitchell Bagot+12−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove old consensus code from examples

This commit only updates example code in the rust-bitcoin project. It replaces older 'consensus' encoding/decoding API calls with newer 'consensus_encoding' API calls in three example files. There is no change to the library's actual secur…

d5cbd077by Mitchell Bagot+22−193 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Adjust fuzz targets to use consensus_encoding

This commit only updates internal fuzz-testing code to use a newer serialization API (consensus_encoding) instead of an older one being removed. It does not change the library's runtime behavior or fix any security bug.

f5041528by Mitchell Bagot+27−249 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): allow fallible conversion of `i16` into `Obj`

This is a small, safe Rust language addition that lets the firmware convert a signed 16-bit integer (i16) into an internal MicroPython object type, mirroring existing conversions already done for unsigned 8-bit and 16-bit integers. There i…

8ad34606by Roman Zeyde+10−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/eckhart): simplify device menu handling

This is a code cleanup (refactor) for the device menu on a specific Trezor hardware wallet model. It changes how menu actions are represented internally (from numbers to named strings) and simplifies how the menu decides which submenu to s…

e6e514c9by Roman Zeyde+163−1497 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): keep vertical offset when reloading device menu

This commit fixes a visual glitch on the Trezor T3W1 device where the device menu would visibly jump or flicker when it refreshed. The fix preserves the menu's current scroll position across refreshes by passing an extra offset value throu…

No security-relevant signals observed in the diff.Change is described in changelog as '[T3W1] Fix device menu refresh.'No input validation, memory safety, cryptographic, or authorization changes are present.
f383055eby Roman Zeyde+70−1713 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): update UI fixtures

This commit only updates expected visual test fingerprints (hashes of UI screenshots) in a test data file. No actual product code was changed, so it cannot introduce or fix a security vulnerability on its own.

c9e32e77by Roman Zeyde+72−721 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

qa: Strip prefix length from NetBSD `ifconfig` output

This is a tiny test-only fix for parsing network interface output on NetBSD. It changes one regular expression so that Bitcoin Core's functional tests can correctly read IP addresses when NetBSD prints them in CIDR notation (like 127.0.0.1…

70352fdaby Hennadii Stepanov+1−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →