CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17880Commits captured
17297AI analyses
100High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17297 analyses
Highest risk·RSS
Moderate 59 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

assets: improve precision checking

This commit tightens how Blockstream Jade handles the 'precision' value in asset contracts for Liquid assets. Previously, a very large precision value could be accepted and later used to read past the end of an internal lookup table (POW_1…

Out-of-bounds read mitigation: bounds-checking of user-controlled precision before indexing fixed-size POW_10 arrayInteger truncation safety: explicit cast of validated precision to uint8_t after range checkCompile-time invariant enforcement: JADE_STATIC_ASSERT ties array size to ASSET_PRECISION_MAX
fd0f625dby Mike Tolkachev+13−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

configs: enable overall stack smashing protection for production devices

This commit strengthens a security guardrail on Blockstream Jade hardware wallets by turning on the most thorough stack-smashing protection for production builds. Stack smashing is a common way attackers try to take control of a device by …

Hardening: stack canary coverage expanded from STRONG to ALLTarget: production hardware-wallet firmware buildsScope: all three supported production hardware variants (Jade v1.1, v2, v2c)
0d8422daby Mike Tolkachev+3−33 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Make CWalletTx "replaces_txid" and "replaced_by_txid" member variables

This commit is a small internal cleanup in Bitcoin Core's wallet code. It moves two pieces of transaction metadata—'replaces_txid' and 'replaced_by_txid'—from a loose string-based key/value map into properly typed member variables of the C…

No security-relevant logic changeRefactoring of wallet metadata storage onlySerialization format remains backward compatible
98d5cdaeby Ava Chow+23−155 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Throw if unknown entry is found in mapValue

This Bitcoin Core wallet patch makes the wallet stricter when reading old transaction metadata. Previously, unknown entries in a wallet's internal 'mapValue' data store were silently ignored. Now the wallet will refuse to load if it sees a…

Data-integrity hardening: unknown wallet metadata now causes load failure instead of silent discardLegacy field cleanup: 'fromaccount' and 'spent' erased before validationDefense-in-depth against future mapValue removal causing data loss
cb99864cby Ava Chow+5−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Drop mapValue from CWalletTx

This commit is a routine internal cleanup in Bitcoin Core's wallet code. It removes an old string-to-string metadata map called mapValue from wallet transactions and replaces it with direct typed fields. The change keeps the same data on d…

No security-relevant keywords in commit title or messageNo bug-fix or CVE references in commit or supplied materialsChange is a structural refactor with equivalent serialization behavior
a2b0bfcdby Ava Chow+16−656 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 65 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Make CWalletTx "comment" and "to" member variables

This commit is a straightforward internal cleanup in Bitcoin Core's wallet code. It moves two optional user-provided text fields, 'comment' and 'to', out of a generic key/value map and into explicit named member variables on the wallet tra…

No security-relevant behavior change observedRefactor only: same data stored and exposed via same RPC keysBackward-compatible serialization preserved
7ef8a6efby Ava Chow+30−158 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Make CWalletTx "from" and "message" member variables

This is a small code cleanup in Bitcoin Core's wallet. It moves two very old, rarely-used pieces of transaction metadata—'from' and 'message'—out of a generic key/value map and into explicit named fields. The change preserves the same data…

No security-relevant change: pure refactor of deprecated metadata fieldsHTML escaping of 'from' and 'message' remains unchanged in Qt UIBackward-compatible serialization preserves existing wallet data
2155e913by Ava Chow+30−146 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Pass comment and comment_to to CommitTransaction

This is a routine internal code cleanup in Bitcoin Core's wallet. It changes how optional user comments (like a note on a payment) are passed through the code, moving them from a generic key-value map to explicit function parameters. The a…

00abb174by Ava Chow+20−113 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Drop mapValue from CommitTransaction

This is a routine internal code cleanup in Bitcoin Core's wallet. It removes an old way of passing extra transaction details (called mapValue) and replaces it with explicit named parameters. The change does not alter what the wallet record…

No security-relevant behavior change: same mapValue keys are still written to the wallet transaction recordRefactor-only signature change: removal of generic mapValue parameter in favor of explicit optional parametersNo validation, cryptography, consensus, or networking code modified
c6ba98dcby Ava Chow+8−128 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Pass replaces_txid to CommitTransaction outside of mapValue

This is a small internal code cleanup in Bitcoin Core's wallet. It changes how a transaction ID is passed when a user bumps a transaction fee, moving the value from a general metadata map into a dedicated function parameter. There is no se…

1a219a37by Ava Chow+15−63 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid heap-allocating background processor futures

This is a routine performance and code-quality improvement. It replaces heap-allocated 'boxed' futures with stack-pinned futures in a background processor loop, removing one memory allocation per loop iteration. There is no security vulner…

3cad6af6by Abeeujah+90−811 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

consensus_encoding: always enable alloc for serde

This is a small build-configuration cleanup, not a security fix. The change makes the 'alloc' feature automatically enabled whenever the 'serde' feature is enabled, because serializing to non-human-readable formats requires allocating memo…

d6730d68by Nick Johnson+2−23 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →