Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

24Projects watched
17788Commits captured
17252AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17252 analyses
Highest risk·RSS
Informational 16 AI analysisMessage 60 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Add `lsof` to Test Suite Dependencies on NetBSD

This commit only updates the NetBSD build documentation to add the `lsof` utility as a test suite dependency and explains how to force-install it if needed. It is a documentation-only change with no code modifications and no security relev…

5e96a8fdby Hennadii Stepanov+8−11 file
No security note in commit
Informational 16 AI analysisMessage 65 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

qa: Support `get_bind_addrs` and `feature_bind_extra` on illumos

This is a small test-only change that lets Bitcoin Core's internal test tools recognize the illumos operating system (reported as 'sunos5') when listing network addresses and interfaces. It does not change the Bitcoin node software itself,…

f4a6d079by Hennadii Stepanov+4−41 file
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

qa: Drop OpenBSD from supported platforms in `get_bind_addrs` function

This is a small test-only change. A helper function used by Bitcoin Core's automated tests is being updated to no longer claim OpenBSD as a supported platform, because OpenBSD does not include the 'lsof' tool that the function relies on. I…

4cb7f39cby Hennadii Stepanov+2−11 file
No security note in commit
Informational 15 AI analysisMessage 60 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Add `lsof` to Test Suite Dependencies on FreeBSD

This commit simply updates the FreeBSD build documentation to add the `lsof` utility to the list of packages needed to run the test suite. It is a documentation-only change with no code modifications and no security implications.

1c173556by Hennadii Stepanov+1−11 file
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

qa: Add `skip_if_no_lsof_on_nonlinux` helper and use it where needed

This is a harmless test-suite maintenance change. It adds a helper that skips certain Bitcoin Core functional tests on non-Linux systems when the 'lsof' tool is missing. It does not change the actual Bitcoin node software, network rules, w…

8a982eeaby Hennadii Stepanov+7−03 files
No security note in commit
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: introduce a worker thread in http socket error test

This is a test-only change. It updates a single unit test file to run the HTTP request handler on a separate worker thread instead of handling it synchronously. There is no change to production code, no security fix, and no vulnerability.

b98b10c0by Matthew Zipkin+15−31 file
No security note in commit
Low 42 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: ensure HTTPServer race condition is fixed

This commit only changes a test file. It strengthens an existing test for the Bitcoin Core HTTP server so it can better catch a race condition where the server might stop reading new requests from a connection. The commit itself does not c…

Race condition in HTTP server request handlingPotential denial-of-service symptom: server stops reading from a socketTest-only change, not a production fix
f595daf1by Matthew Zipkin+29−21 file
No security note in commit
Informational 14 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: socket error handling in HTTPServer using ErrorSock mock socket

This commit only adds new unit tests for the Bitcoin Core HTTP server. It creates a fake network socket that sometimes returns a 'try again' error, then verifies the server retries and still sends all replies. No production code is changed…

No changes to production/network codePure test-coverage addition for existing retry behaviorMock socket injection only reachable in unit tests
922b08d3by Matthew Zipkin+129−203 files
No security note in commit
Moderate 62 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

http: prevent race condition between worker thread and I/O thread

This commit fixes a subtle timing bug in Bitcoin Core's built-in HTTP server. Under a specific race between a worker thread preparing a response and the I/O thread sending data, a connection could get permanently stuck waiting to write eve…

Race condition between worker thread and I/O thread on shared statePotential denial-of-service via hung HTTP connectionLock ordering comment to prevent deadlock regression
73da2a8aby Matthew Zipkin+24−102 files
No security note in commit
Low 28 AI analysisMessage 76 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: disallow wallet names starting with '.'

This commit stops users of Electrum's mobile-style QML interface from giving a wallet a name that begins with a dot (like '.secret'). Such 'hidden' files are normally invisible in the wallet list, so a user could create a wallet and then b…

UI-level input validation hardeningPrevents creation of hidden wallet files that would be omitted from wallet listAvoids potential user lock-out / inaccessible funds due to hidden filename
04eb5a19by f321x+3−01 file
No security note in commit
Informational 18 AI analysisMessage 45 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

fixup! trezor: support Safe 7

This is a tiny follow-up patch that changes how error messages from Trezor hardware wallets are displayed in Electrum's setup wizard. It switches from showing a programmer-style representation (repr) to a more readable plain-text message (…

No security-relevant code paths modifiedNo input validation, authentication, or cryptographic changesNo memory-safety, privilege, or authorization changes
154d79ebby Roman Zeyde+2−21 file
No security note in commit
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this