CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17865Commits captured
17284AI analyses
99High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17284 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

util, refactor: Rename local `ERR` in `Sock::Accept`

This is a simple code cleanup change: a local constant named ERR inside one function was renamed to accept_error because it happened to have the same name as a class-level constant. The rename avoids confusion for programmers but does not …

7ac25c91by Hennadii Stepanov+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): enable VCP for PYOPT=0 firmware

This commit changes the build settings for Trezor's core firmware so that when a special debug/development build is made (with optimization disabled, PYOPT=0), a Virtual COM Port (VCP) debug console is enabled. This is a build/debugging fe…

Debug console enabled for non-production firmware builds onlyNo changelog entry providedNo mention of security, CVE, vulnerability, or researcher attribution in commit
fad75e2dby Martin Milata+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): Show plain warning for multisig GetAddress.

This commit changes the on-screen prompt shown on Trezor T3T1 and T3W1 devices when a user requests a multisig address or signs a transaction that spends from multiple accounts. Previously the device displayed a hard-to-dismiss 'danger' di…

UI severity downgrade from danger dialog to warning dialogNo cryptographic, authorization, or validation logic changedNo CVE, advisory, or security disclosure referenced in commit or supplied materials
311c950aby Andrew Kozlik+392−4084 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: Bump tsan config to ubuntu:26.04 with -U_FORTIFY_SOURCE

This is a routine Continuous Integration (CI) configuration update. It changes the version of the Linux container used for one automated test job and adds a compiler flag to work around a known build issue. There is no change to the Bitcoi…

bbbbab86by MarcoFalke+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

makefile: update: update-ccan

This commit changes a single line in the build Makefile. It updates the 'update-ccan' recipe so that when the project copies code from the CCAN library, it records the exact Git commit hash instead of a Git tag-based version string. This i…

77c47f5bby Níckolas Goline+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 60 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

ccan: update ccan to efd48386

This commit updates a bundled helper library (ccan) and fixes a small but meaningful networking bug in its event loop. Previously, when a socket reported an error, the code always assumed the generic error 'bad file descriptor' (EBADF). No…

Error-handling path changed from a hardcoded generic errno to a real socket error retrieved via getsockopt(SO_ERROR)Cross-platform macOS/Linux behavior divergence in poll(2) error reporting for connect() failuresPotential for downstream logic to behave differently now that ECONNREFUSED (or other real errors) is propagated instead of EBADF
2003dca7by Níckolas Goline+14−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: add reader exhaustion helper

This commit adds a new helper function to the PSBT (Partially Signed Bitcoin Transaction) package that checks whether a data reader still has leftover bytes after parsing. Leftover bytes could mean a malformed or malicious PSBT file was no…

New validation helper for trailing/leftover data in a binary parserLocated in PSBT parsing utilities, an area where malformed input handling mattersNo caller added in this commit, so defensive effect is not yet active
da5792a8by Boris Nagaev+25−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: reject trailing data in tx values

This change tightens how PSBT (Partially Signed Bitcoin Transaction) files are read. Previously, transaction-valued fields could contain extra bytes after the valid transaction data; now the parser rejects such trailing data. This prevents…

Strict parsing of serialized transaction fieldsRejection of trailing/padding bytes in PSBT transaction valuesPrevention of ambiguous or malleable PSBT parsing
f945179fby Boris Nagaev+26−63 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: add strict tx value regression test

This commit only adds a new test file. It does not change any production code. The test checks that the PSBT parser rejects transaction fields that have extra trailing bytes. Because no actual parser logic is modified, this commit by itsel…

Regression test added for strict parsing of transaction-valued PSBT fieldsNo production code changes
0293b6e0by Boris Nagaev+117−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: reject trailing packet data

This change makes the PSBT (Partially Signed Bitcoin Transaction) parser reject files or data that have extra bytes after the end of a valid PSBT. Previously, extra trailing data was silently ignored, which could let an attacker hide malic…

Parser no longer ignores trailing bytesCould prevent smuggling of extra data inside PSBT containersCould prevent canonicalization attacks where different byte sequences parse to the same structure
d1de2bc3by Boris Nagaev+4−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: test trailing packet data rejection

This commit only adds a new test case. It does not change any production code. The test checks that the PSBT parser rejects files that have extra bytes after a valid PSBT packet. Because no code behavior is changed, this commit by itself d…

Test-only commitNo production code changesTests input-validation behavior (trailing data rejection)
0a1300ddby Boris Nagaev+16−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

psbt: parse witness utxo txouts strictly

This commit tightens how a Bitcoin-related library reads transaction outputs stored inside PSBT (Partially Signed Bitcoin Transaction) data. Previously, the code read the output value and script in a loose, hand-rolled way that ignored ext…

Strict canonical parsing of serialized transaction outputsRemoval of hand-rolled length handling that ignored script length byteAddition of full-consumption check on parsed witness UTXO data
b4c5cf16by Boris Nagaev+11−91 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →