CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17865Commits captured
17284AI analyses
99High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17284 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 65 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

cmake: Remove `SelectLibraryConfigurations` from `FindQRencode` module

This commit is a minor cleanup of the CMake build script used to locate the QR code encoding library. It removes an unnecessary helper function and simplifies how the library target is created. There is no indication this change fixes or i…

829255c8by Hennadii Stepanov+10−191 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

revert SSSP bypass PIN login

This commit reverts a previous security fix. The original fix prevented a 'bypass PIN' (a special trick PIN that hides the wallet) from being used a second time to finish logging in without ever entering the real main PIN. After this rever…

Reverts a prior bugfix that enforced main PIN verification after a trick PIN unlockRemoves has_secrets() check that blocked zero-secret bypass PIN reuse at second login promptChangelog removal of security-relevant bugfix description
542dcd32by scgbckbone+211−163 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

depends: Remove unused `lib/pkgconfig` in `qrencode` package

This is a minor cleanup change in Bitcoin Core's build system. It removes an unused 'pkgconfig' metadata directory left over after building the qrencode (QR code generation) dependency. There is no security issue here.

5c55606dby Hennadii Stepanov+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

core(ci): added run-name for hardware tests workflow [no changelog]

This commit only adds a display name (run-name) to a GitHub Actions workflow that runs hardware tests. It does not change any code that runs on the Trezor device or any test logic. There is no security relevance.

44cc50e7by Michal Kazda+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

cmake: Drop optional `PkgConfig` use in `FindQRencode` module

This commit removes an optional way CMake can locate the QR code library (libqrencode). Previously, the build system could use pkg-config to find the library's location and version. Now it will rely only on CMake's standard search paths. T…

402ba10bby Hennadii Stepanov+0−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: add send RPC release note

This commit is a documentation-only release note. It announces that two wallet commands, `send` and `sendall`, are no longer considered experimental. There is no code change, no bug fix, and no security issue in the commit itself.

8ebfff0fby Sjors Provoost+4−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

tests: Fix GCC 17 snapshot warning

This is a test-only cleanup. The commit removes a unit test pattern that passed a stack-allocated (non-malloc) scratch-space object to a destroy function that could call free(), which is undefined behavior. The test logic is reimplemented …

Undefined behavior in test code: passing a stack pointer to a function that may call free()Test relied on the tested function not reaching the free() pathNo change to library implementation or public API behavior
9d75769dby Tim Ruffing+16−101 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Add blog post announcement

This commit only adds a link to a blog post announcement in the changelog. It contains no code changes, no security fixes, and no functional modifications.

e5c2a4ccby Nicolas Dorier+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Clarify build docs about `pkgconf` / `pkg-config` requirements

This commit only updates documentation. It moves the pkgconf/pkg-config package from the 'always required' dependency list to the 'only needed if you enable ZMQ' list, because ZMQ packages sometimes need it to be found by the build system.…

fb8a1038by Hennadii Stepanov+13−114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: QEInvoice: check if channels are still reestablishing

This commit is a user-experience fix, not a security fix. It changes the mobile/QML wallet's invoice screen so that, if Lightning channels are still reconnecting right after the app starts, the user sees a 'Connecting to Lightning peers...…

00549808by f321x+55−132 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: remove experimental warning from send RPCs

This commit simply removes the word 'EXPERIMENTAL' from the help text of two wallet commands, 'send' and 'sendall'. It does not change how those commands work, what data they accept, or how secure they are. It is a documentation-only clean…

5884f5a4by Sjors Provoost+2−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

qml: InvoiceDialog: fix onCompleted operator precendence bug

This is a tiny UI bug fix in Electrum's mobile/QML wallet interface. The original code accidentally checked the wrong condition when opening an invoice dialog, due to operator precedence: `!invoice.status == Invoice.Expired` was interprete…

Operator-precedence bug in UI conditionNo involvement of cryptography, network, or transaction authorizationBehavioral change limited to dialog initialization/edit-mode state
9d42454bby f321x+1−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →