CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17865Commits captured
17284AI analyses
99High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17284 analyses
Highest risk·RSS
Informational 12 AI analysisMessage 60 · Adequate
BT btcsuitebtcd BitcoinNode implementations

rpc: test sendrawtransaction trailing byte rejection

This commit only adds a new unit test. It does not change any production code. The test verifies that the sendrawtransaction RPC already rejects transaction hex strings that have extra trailing bytes after a valid transaction. Because no a…

Strict deserialization of raw transactions is a desirable defensive propertyThe test confirms trailing bytes are rejected, which can prevent certain malleability or parsing-confusion issuesNo production code is changed in this commit
8074ebe9by Boris Nagaev+32−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

rpc: decode raw transaction RPC input strictly

This commit changes how the 'decoderawtransaction' RPC command reads raw transaction bytes. Previously it used a looser deserialization method that could accept data beyond the end of the transaction. Now it uses a stricter parser that rej…

Stricter input validation on an RPC endpointReplacement of permissive deserialization with exact-length parsingPotential for transaction malleability / ambiguity if trailing bytes were previously ignored
0d7259eeby Boris Nagaev+4−41 file
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 60 · Adequate
BT btcsuitebtcd BitcoinNode implementations

rpc: test decoderawtransaction trailing byte rejection

This commit adds a new test to make sure the 'decoderawtransaction' RPC command rejects transaction data that has extra bytes tacked on after a valid transaction. It does not change the actual command behavior; it only adds a test confirmi…

Strict deserialization / trailing-byte rejectionRPC input validation regression test
40aca93cby Boris Nagaev+15−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

rpc: decode block proposals strictly

This commit changes how submitted block proposals are decoded in the Bitcoin RPC server. It switches from a loose block parser to a stricter one that validates the block more thoroughly before accepting it. The likely goal is to prevent ma…

Stricter input validation on externally supplied block dataChange from manual deserialization to higher-level validated helperPotential mitigation of malformed block proposal handling
7840b814by Boris Nagaev+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

rpc: test block proposal trailing byte rejection

This commit only adds a new test to btcd. The test checks that a specific Bitcoin RPC command, used when miners propose new blocks, correctly rejects block data that has extra junk bytes tacked onto the end. The commit itself does not chan…

Trailing-byte deserialization test for block proposal RPCDefensive assertion that malformed input returns ErrRPCDeserialization rather than reaching chain statePattern consistent with prior tests for sendrawtransaction and decoderawtransaction trailing-byte rejection
ac17d232by Boris Nagaev+33−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

rpc: test submitblock trailing byte rejection

This commit only adds a new test. It checks that the submitblock RPC command rejects block data that has extra trailing bytes after a valid block. The test confirms existing behavior rather than changing production code, so it is unlikely …

Test verifies rejection of malformed/trailing-byte block submissionsRelated to prior test for getblocktemplate proposal trailing-byte rejectionDeserialization error path is the expected safe behavior
676f61b9by Boris Nagaev+17−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

rpc: test mempool accept trailing byte rejection

This commit only adds a new unit test. It checks that the Bitcoin RPC command testmempoolaccept correctly rejects a transaction hex string that has extra trailing bytes. There is no code fix or behavior change in the main program—just a te…

Test verifies deserialization strictness for testmempoolaccept RPC inputTrailing-byte rejection is a common input-validation hardening measureNo production code change; signal strength is low
f3ec349aby Boris Nagaev+19−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 45 · Thin
BT btcsuitebtcd BitcoinNode implementations

blockchain: load database blocks strictly

This commit changes how btcd reads blocks from its internal database when starting up. Previously it used a loose block parser (wire.MsgBlock.Deserialize) that could accept data with extra trailing bytes. Now it uses btcutil.NewBlockFromBy…

Stricter deserialization of attacker-influenced/local database contentRemoval of lenient block parsing during chain initializationPotential mitigation against stored-data tampering or corruption being silently accepted
29cfb6ecby Boris Nagaev+3−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 55 · Thin
BT btcsuitebtcd BitcoinNode implementations

blockchain: test strict best block loading

This commit only adds a new test to the btcd blockchain package. The test verifies that when the software starts up, it rejects a stored 'best block' whose saved bytes contain extra trailing data after the valid block. It does not change a…

Regression test for strict deserialization of stored best block bytesNo production code changesNo vulnerability fix or behavior change in runtime code
934349f1by Boris Nagaev+49−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 93 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(deps): bump cryptography to v48.0.1

This commit updates a third-party Python cryptography library used by Trezor's firmware build tools from version 48.0.0 to 48.0.1. The change is a routine dependency patch triggered by an automated security alert (GitHub Dependabot). It do…

Dependency version bump for a widely-used cryptographic libraryReferences a GitHub Dependabot security alertNo direct code changes to Trezor firmware or runtime logic
b8952401by M1nd3r+54−542 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

log: expose -logratelimit option

This commit simply makes an existing command-line option, -logratelimit, visible in the normal help output. It does not change how the option works, what it protects against, or any code behavior. It is a documentation/usability change onl…

095596ddby Lőrinc+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(deps): added `construct-typing` for typechecking

This commit only adds a development dependency called construct-typing to improve type checking and adjusts some type-checker ignore comments. It does not change how the Trezor firmware or tools behave at runtime, and it does not fix or in…

855c08a9by M1nd3r+26−108 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →