CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17870Commits captured
17288AI analyses
99High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17288 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: fix flaky bwatch 1-block reorg test

This commit fixes a flaky automated test for a Core Lightning plugin called bwatch. The test was sometimes failing because it reorged a block before the plugin had actually recorded it, so the plugin saw the replacement as a normal new blo…

d573b58cby Sangbida Chaudhuri+5−11 file
No security note in commit
Open full analysis →Source commit ↗
High 76 AI analysisMessage 23 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

security improvements

This BitBox02 firmware update is a broad security patch that fixes several independent bugs: it prevents a maliciously oversized USB report from overflowing memory, stops a corrupted Bluetooth pairing database from being read or written wi…

Bounds check added to USB HID Set Report input lengthBLE bond DB length validation hardened against negative and oversized valuesBootloader firmware image size limit relaxed to intended maximum
cbb40634by Marko Bencun+1117−25021 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 60 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: allow full sized images

This commit fixes a bootloader bug where the device rejected firmware updates that used the maximum allowed size. The off-by-one check meant legitimate full-sized firmware images could not be installed, potentially blocking updates. The fi…

Off-by-one input validation in firmware-update pathBootloader change affecting firmware chunk count acceptanceCHANGELOG labels the change as a bugfix for full-sized firmware upgrades
f60b93ccby Marko Bencun+5−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: slow down rescaning process

This commit only changes a test file. It adds code to generate extra blocks during a wallet rescan test so the rescanning process takes longer. There is no change to production Bitcoin Core code, no security fix, and no vulnerability.

9e62e4b1by Pol Espinasa+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

fuzz: rename old_bitcoin to bitcoin_0_32

This commit is a simple renaming of a dependency alias used only in fuzz testing code. It changes 'old_bitcoin' to 'bitcoin_0_32' throughout the fuzz test suite and generation script. There is no change to production code, no security fix,…

e739ebb8by Nick Johnson+70−7010 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

fuzz: migrate 0.32.x fuzz targets to master

This commit only adds and reorganizes fuzz testing code. It brings older 0.32.x fuzz targets onto the master branch and switches them from hongfuzz to libfuzzer. There are no changes to production library code, so ordinary users of the cra…

f01340eeby Nick Johnson+481−7113 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

currencyrate: vendor root certificates with webpki-roots

This commit fixes a startup failure in the cln-currencyrate plugin on systems that do not have operating-system root certificates installed. Previously the plugin would crash with a generic 'builder error' because it had no trusted certifi…

Fixes TLS certificate validation failure on systems lacking OS root certificatesVendors a static root certificate store (webpki-roots)Improves error-message clarity for proxy, source, and oracle construction failures
47a22d2cby daywalker90+40−64 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

release: CHANGELOG and version bumps for v26.06.2

This commit is a routine release bookkeeping change: it bumps version strings and adds a CHANGELOG entry for Core Lightning v26.06.2. The changelog describes the actual fix as a build-time issue in the cln-currencyrate plugin where missing…

CHANGELOG describes a build-time fix for missing TLS root certificates in cln-currencyrateNo functional code changes in this commitNo cryptographic, networking, or permission changes in this commit
c9b25bceby daywalker90+33−1110 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

ci: run only one qemu job per physical box

This commit changes a CI/CD configuration file so that QEMU-based test jobs run on a dedicated GitLab runner tag (ga-qemu) instead of a shared one (ga). The stated purpose is to limit QEMU jobs to one per physical CI box, likely to avoid r…

18fdfd07by Jon Griffiths+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 62 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

rpc: annotate functions returning error codes to ensure they are checked

This commit adds compiler annotations (WARN_UNUSED_RESULT) to functions that return success/failure codes, so the compiler will warn if a caller ignores the result. It also fixes a few places where return values were being ignored, replaci…

Functions returning error/success codes annotated with WARN_UNUSED_RESULTCallers now check return values of rpc_get_bip32_path() and rpc_get_boolean()Use of default-value helpers (rpc_get_boolean_or) to ensure predictable behavior on missing fields
517075baby Mike Tolkachev+24−215 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

rpc: rename get_boolean to get_bool

This commit is a simple rename of two internal helper functions from `rpc_get_boolean`/`rpc_get_boolean_or` to `rpc_get_bool`/`rpc_get_bool_or`, updating all call sites accordingly. There is no change to what the code does, no bug fix, and…

f6e946acby Jon Griffiths+24−2518 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →