CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17858Commits captured
17280AI analyses
99High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17280 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: restore CreateSock in PCP targets

This commit fixes a small cleanup issue in Bitcoin Core's internal fuzz testing code. Fuzz tests are automated tools that feed random data into functions to find bugs; they are not part of the live Bitcoin network software. The change save…

No production code changedChange is confined to fuzz test harnessNo memory safety, cryptographic, or consensus modifications
a0e5e300by Hao Xu+6−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 82 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): logic error in `ToifInfo::parse`

This commit fixes a logic bug in how the Trezor hardware wallet checks image files used as custom home screens. The old code accidentally accepted almost any image as valid because it used 'AND' instead of 'OR' when checking the file's mag…

Logic error in format/magic-byte validationInput validation bypass for custom homescreen imagesRemoval of an input size limit for stored homescreen data
368d6203by obrusvit+84−655 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: Rename `StatusLevel::{INFO,WARN,ERR}`

This is a straightforward code cleanup change that renames three internal status labels (INFO, WARN, ERR) to different capitalisation (Info, Warn, Error) because one of those names clashed with a system macro on illumos operating systems w…

41ceea40by Hennadii Stepanov+24−242 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: Rename `Sock::{RECV,SEND,ERR}`

This commit is a simple rename of three internal constants used by Bitcoin Core's socket-handling code. The old names (RECV, SEND, ERR) clashed with a macro named ERR on illumos-based operating systems, preventing the software from compili…

f395acdeby Hennadii Stepanov+49−4913 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 83 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

primitives: Implement ExactSizeEncoder for WitnessEncoder

This commit adds a missing 'ExactSizeEncoder' implementation for the WitnessEncoder in the rust-bitcoin library. Previously, WitnessEncoder only implemented the basic Encoder trait, even though the underlying encoders already supported exa…

Missing trait implementation could have caused callers relying on ExactSizeEncoder to use fallback length estimation or fail to compileNo memory safety issue, no input validation bypass, no cryptographic weakness evident in diffChange is API-completeness/correctness rather than a vulnerability patch
8a3c27d9by awn+55−203 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

docs(core/rust): fix a small typo

This commit fixes a spelling mistake in a code comment ('Chcek' to 'Check'). No program logic, user interface behavior, or security properties were changed.

72540c6cby Roman Zeyde+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core/rust): use `deref()` instead of `deref_mut()`

This is a one-line code cleanup in the user-interface code for a Trezor hardware wallet screen. It changes a mutable borrow (`deref_mut`) to an immutable borrow (`deref`) where the code only reads a value. This is a routine Rust style/refa…

No security-relevant keywords in commit title or messageChange is a single borrow mutability reduction with no functional changeNo changelog entry requested by author
61557dcaby Roman Zeyde+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): update translated fixtures

This commit only updates expected test-result fingerprints (hashes) in a single test data file. It does not change any firmware, application, or cryptographic code. There is no security-relevant change visible in the diff.

cdf92109by Martin Milata+400−3601 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

util, refactor: Rename local `ERR` in `Sock::Accept`

This is a simple code cleanup change: a local constant named ERR inside one function was renamed to accept_error because it happened to have the same name as a class-level constant. The rename avoids confusion for programmers but does not …

7ac25c91by Hennadii Stepanov+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): enable VCP for PYOPT=0 firmware

This commit changes the build settings for Trezor's core firmware so that when a special debug/development build is made (with optimization disabled, PYOPT=0), a Virtual COM Port (VCP) debug console is enabled. This is a build/debugging fe…

Debug console enabled for non-production firmware builds onlyNo changelog entry providedNo mention of security, CVE, vulnerability, or researcher attribution in commit
fad75e2dby Martin Milata+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): Show plain warning for multisig GetAddress.

This commit changes the on-screen prompt shown on Trezor T3T1 and T3W1 devices when a user requests a multisig address or signs a transaction that spends from multiple accounts. Previously the device displayed a hard-to-dismiss 'danger' di…

UI severity downgrade from danger dialog to warning dialogNo cryptographic, authorization, or validation logic changedNo CVE, advisory, or security disclosure referenced in commit or supplied materials
311c950aby Andrew Kozlik+392−4084 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: Bump tsan config to ubuntu:26.04 with -U_FORTIFY_SOURCE

This is a routine Continuous Integration (CI) configuration update. It changes the version of the Linux container used for one automated test job and adds a compiler flag to work around a known build issue. There is no change to the Bitcoi…

bbbbab86by MarcoFalke+3−21 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →