CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17788Commits captured
17255AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17255 analyses
Highest risk·RSS
Moderate 62 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

http: prevent race condition between worker thread and I/O thread

This commit fixes a subtle timing bug in Bitcoin Core's built-in HTTP server. Under a specific race between a worker thread preparing a response and the I/O thread sending data, a connection could get permanently stuck waiting to write eve…

Race condition between worker thread and I/O thread on shared statePotential denial-of-service via hung HTTP connectionLock ordering comment to prevent deadlock regression
73da2a8aby Matthew Zipkin+24−102 files
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 76 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: disallow wallet names starting with '.'

This commit stops users of Electrum's mobile-style QML interface from giving a wallet a name that begins with a dot (like '.secret'). Such 'hidden' files are normally invisible in the wallet list, so a user could create a wallet and then b…

UI-level input validation hardeningPrevents creation of hidden wallet files that would be omitted from wallet listAvoids potential user lock-out / inaccessible funds due to hidden filename
04eb5a19by f321x+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

fixup! trezor: support Safe 7

This is a tiny follow-up patch that changes how error messages from Trezor hardware wallets are displayed in Electrum's setup wizard. It switches from showing a programmer-style representation (repr) to a more readable plain-text message (…

No security-relevant code paths modifiedNo input validation, authentication, or cryptographic changesNo memory-safety, privilege, or authorization changes
154d79ebby Roman Zeyde+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 68 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

wallet: followup d2d4251c8 (paid invoice cache)

This is a small internal cleanup commit for the Electrum Bitcoin wallet. It renames an in-memory cache used to remember which outgoing invoices have been paid, moves where the cache is initialized, simplifies some related logic, and makes …

No security-relevant keywords in commit title or messageRefactor/cleanup of existing caching logic onlyNo new dependencies, network endpoints, or trust assumptions
4f897200by f321x+47−552 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add XOnlyPublicKey::verify

This commit adds a new convenience method, XOnlyPublicKey::verify, that lets users verify Schnorr (taproot) signatures without calling the underlying secp256k1 library directly. It is a straightforward API addition with no obvious security…

New public API surface for signature verificationWraps secp256k1::schnorr::verify without altering verification semanticsNo input parsing, no secret-key handling, no allocator changes
8a5deee2by Mitchell Bagot+28−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

depends: add openbsd_LDFLAGS

This commit adds an empty placeholder for OpenBSD linker flags in the dependency build system. It is a build configuration change with no functional or security effect visible in the diff.

5404b620by fanquake+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: add openBSD cross CI job

This commit adds a new automated build test for Bitcoin Core that cross-compiles for OpenBSD. It downloads official OpenBSD system files from the OpenBSD project's own download server and sets up the build environment. There is no change t…

d64ea158by fanquake+60−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: update stage1 binaries to v1.2.2

This commit simply swaps in newer pre-built bootloader stage1 binary files (version 1.2.2 replacing 1.2.1) for four BitBox02 hardware variants and updates the corresponding checksum list. The actual code inside the new binary files is not …

5940a800by Marko Bencun+8−86 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 50 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

SECURITY.md: remove Jonas Nick from trusted keys

This commit updates documentation to remove one person's cryptographic key from the project's list of trusted security contacts, and updates the README's example release tag and signature to reflect a newer release signed by a different tr…

Removal of a trusted GPG key from SECURITY.md contact listUpdate of release-tag verification example to a newer release and different signerNo code or cryptographic implementation changes
21645c03by Jonas Nick+9−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Move TapTweak trait to taproot-primitives

This commit is a routine code reorganization. It moves the TapTweak trait and its implementations from the main bitcoin crate into a smaller taproot-primitives crate. The actual logic for tweaking Taproot keys is copied unchanged; only its…

6912358eby Mitchell Bagot+92−872 files
No security note in commit
Open full analysis →Source commit ↗
Informational 10 AI analysisMessage 0 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix build

This is a one-line build fix that changes a padding length constant from 1 to 2 in a file used only for Bitcoin-only firmware builds. There is no indication in the commit of any security issue, vulnerability, or functional bug. It appears …

5e26e323by ww3512687+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

docs: update sign_tx docs to include genesis_hash

This commit only updates documentation. It adds a description of an optional 'genesis_hash' parameter for Liquid transaction signing and removes trailing whitespace. There are no code changes, so it cannot directly introduce or fix a secur…

b937de6fby Jon Griffiths+12−101 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →