CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17870Commits captured
17288AI analyses
99High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17288 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Clarify build docs about `pkgconf` / `pkg-config` requirements

This commit only updates documentation. It moves the pkgconf/pkg-config package from the 'always required' dependency list to the 'only needed if you enable ZMQ' list, because ZMQ packages sometimes need it to be found by the build system.…

fb8a1038by Hennadii Stepanov+13−114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: QEInvoice: check if channels are still reestablishing

This commit is a user-experience fix, not a security fix. It changes the mobile/QML wallet's invoice screen so that, if Lightning channels are still reconnecting right after the app starts, the user sees a 'Connecting to Lightning peers...…

00549808by f321x+55−132 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: remove experimental warning from send RPCs

This commit simply removes the word 'EXPERIMENTAL' from the help text of two wallet commands, 'send' and 'sendall'. It does not change how those commands work, what data they accept, or how secure they are. It is a documentation-only clean…

5884f5a4by Sjors Provoost+2−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

qml: InvoiceDialog: fix onCompleted operator precendence bug

This is a tiny UI bug fix in Electrum's mobile/QML wallet interface. The original code accidentally checked the wrong condition when opening an invoice dialog, due to operator precedence: `!invoice.status == Invoice.Expired` was interprete…

Operator-precedence bug in UI conditionNo involvement of cryptography, network, or transaction authorizationBehavioral change limited to dialog initialization/edit-mode state
9d42454bby f321x+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: InvoiceDialog: update fiat label onQuotesUpdated

This is a user-interface bug fix for Electrum's mobile/QML app. When opening a payment invoice quickly after starting the app, the fiat (local currency) value label could stay stuck showing 'quotes unavailable' even after exchange-rate quo…

5ff31dfaby f321x+10−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: remove some packages from Chimera job

This is a routine cleanup of the continuous integration (CI) build script for a Chimera Linux test job. It removes a few unused build packages (ninja, xz, pkgconf) because the job no longer compiles the Qt graphical wallet interface. There…

58560c28by fanquake+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: add stage0/stage1 production binaries

This commit adds production bootloader upgrade files for the BitBox02 hardware wallet and updates build scripts to use them. It is a routine asset-management change: replacing placeholder development hashes with real signed production bina…

8db4b0dcby Marko Bencun+26−1720 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 83 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: keep dev stage1 unsigned

This commit fixes a build script used only for development/testing versions of the BitBox02 bootloader upgrade. It makes the development-stage1 bootloader images unsigned again, while keeping production images fully signature-verified. The…

Signature verification relaxed only for development buildsProduction payload validation still requires signaturesDevelopment stage0 already skipped stage1 signature verification per commit message
476b90e3by Marko Bencun+9−69 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Add CI job for riscv bare metal

This commit simply adds a new automated testing job to Bitcoin Core's GitHub Actions CI configuration. It runs a build test for a RISC-V 32-bit bare-metal target using a static libbitcoin_consensus library. There is no code change to Bitco…

b36730a3by TheCharlatan+6−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Add CI job for producing a static bare metal binary

This commit adds a new continuous-integration (CI) build job that compiles a small, non-runnable test binary for a RISC-V bare-metal target. It does not change any production wallet, node, or consensus code, and it does not introduce a sec…

bfdbf513by TheCharlatan+123−04 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

build: Add option for building for bare metal envs

This commit adds a new build option for Bitcoin Core that lets developers compile for 'bare metal' environments (systems without a full operating system). It only changes build configuration files to skip features like threads, atomics, an…

a9a1d92aby TheCharlatan+12−45 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ci: add 'brew trust' invocation to macOS CI

This commit is a routine fix to the project's automated macOS testing setup. Homebrew (a package manager for macOS) recently started refusing to load formulas from third-party sources unless explicitly trusted. The change simply tells Home…

66260b78by fanquake+1−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →