CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17793Commits captured
17256AI analyses
98High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17256 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 72 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

docs: update sign_tx docs to include genesis_hash

This commit only updates documentation. It adds a description of an optional 'genesis_hash' parameter for Liquid transaction signing and removes trailing whitespace. There are no code changes, so it cannot directly introduce or fix a secur…

b937de6fby Jon Griffiths+12−101 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 95 · Strong
BS BlockstreamBlockstream Jade BitcoinHardware wallets

Liquid (taproot): add sign_liquid_tx genesis blockhash support

This commit changes how Blockstream Jade handles the 'genesis blockhash' when signing Liquid transactions. Previously, the device only accepted the network's built-in genesis hash. Now it lets users provide a custom genesis hash for test n…

Adds input validation for caller-supplied genesis blockhashPrevents mainnet genesis hash from being used on Liquid test networksRestricts genesis_hash parameter to Liquid networks only
888eff30by Jon Griffiths+82−264 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader/stage1: fix erase handling for partially erased blocks

This update fixes the BitBox02 bootloader's firmware-erase routine. Previously, when erasing leftover padding after a firmware update, the bootloader started erasing at the exact page where the firmware ended. Because flash memory can only…

Bootloader firmware erase routine could erase a flash block containing both firmware and paddingFix aligns erase start to erase-block boundary and re-checks erased state before erasingChangelog describes the change as a fix for 'partially erased flash blocks'
b31206a8by Marko Bencun+23−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

For now disable all windows + macos CI runs until we have runners

This commit simply turns off Windows and macOS automated build tests in the project's CI configuration because the necessary test machines ('runners') are not currently available. It does not change any actual Lightning code, cryptography,…

b86d2b33by Matt Corallo+0−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add Forgejo Actions workflows mirroring GitHub CI

This commit adds new Forgejo-based CI/CD workflow files that mirror the project's existing GitHub Actions. It does not change any application code, cryptographic logic, or user-facing behavior. It is purely an infrastructure change to run …

93ac5802by Matt Corallo+640−06 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Run tor in the background for the tor-connect job

This commit is a routine fix to the project's CI (continuous integration) workflow. It changes how the Tor proxy is started during automated testing so that tests can run on a new runner image that lacks sudo privileges. There is no indica…

7c206895by Matt Corallo+22−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Use preinstalled rustup instead of curling the installer

This commit is a routine cleanup of the project's automated build scripts. It replaces the practice of downloading and running the Rust installer from the internet with using the Rust toolchain manager (rustup) that is already installed on…

c897a448by Matt Corallo+14−145 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Pin actions/checkout + actions/cache to a full URL and commit hash

This commit hardens the project's automated build and test scripts by replacing loose version tags like 'actions/checkout@v4' with exact commit hashes served from a specific domain. This prevents a compromised or renamed third-party action…

CI/CD supply-chain hardeningAction reference pinning to immutable commit hashUse of explicit action mirror URL
3a56fcc2by Matt Corallo+19−196 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Pass commit context to codecov explicitly in coverage job

This commit is a routine CI workflow fix. It tells the Codecov coverage tool the correct repository, commit hash, branch, and pull request number because the project's Forgejo-based CI environment isn't on Codecov's auto-detection list. Th…

4f884af2by Matt Corallo+17−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Comment the codecov report link on PRs

This change adds a CI workflow step that automatically posts or updates a link to a code-coverage report on pull requests. It is purely a developer-convenience automation and does not touch any production code, cryptography, networking, or…

51d0a4f8by Matt Corallo+29−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add workflow to assign a random reviewer on new PRs

This commit adds a harmless automation script that randomly picks a code reviewer when a new pull request is opened. It does not change any payment, cryptography, or network code, and it does not introduce any obvious security flaw.

Uses pull_request_target, but only for API write access and does not check out PR codeNo execution of untrusted code from the pull requestNo changes to cryptographic, networking, or payment-handling logic
311a74cfby Matt Corallo+46−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Replace CWalletTx's vOrderForm with specific fields

This commit is a straightforward internal cleanup in Bitcoin Core's wallet code. It replaces a single mixed-purpose data field called vOrderForm with two clearer fields: one for BIP 21 payment messages and one for BIP 70 payment requests. …

No security-relevant keywords in commit title or messagePure data-structure refactor with behavior-preserving serialization shimNo input validation, parsing, or memory-unsafe changes observed
fed3cf6fby Ava Chow+51−496 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →