CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17880Commits captured
17297AI analyses
100High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17297 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Add recent 0.32.x releases to relevant changelogs

This commit only edits changelog Markdown files. It documents that several prior releases were yanked from crates.io because their required Rust version was raised too aggressively, and it adds notes about newer replacement releases. There…

0c39a2bdby Nick Johnson+79−25 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

coins: pass UTXO stats view by reference

This commit is a small code-quality refactor in Bitcoin Core. It changes several UTXO-statistics helpers so they take a database view by reference instead of by pointer. That removes the possibility of passing a null pointer and makes the …

API hardening: pointer-to-reference conversion removes a nullability contractNo memory-safety bug demonstrated in the diffNo consensus, P2P, wallet, or RPC semantic changes visible
3d2f2d8dby Lőrinc+19−246 files
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

coins: drop stale cursor null checks

This is a small cleanup change in Bitcoin Core that removes leftover null checks after a previous refactor made database cursors always return a valid object. There is no security issue in the diff itself.

72db4accby Lőrinc+1−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

coins: drop cursor from base view

This commit is a routine code cleanup. It removes an unused cursor-iteration method from the base coin-view interface and its empty/forwarding/throwing implementations, keeping the method only on the concrete database class that actually s…

35aedb28by Lőrinc+2−163 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

coins: pass DB view to cursor users

This is a small internal code cleanup in Bitcoin Core. It changes several functions that compute UTXO (unspent transaction output) statistics so they accept a more specific database-view pointer instead of a generic one, because only the c…

c6fbe2f6by Lőrinc+8−74 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 62 · Adequate
LL Lightning LabsLND BitcoinLightning Network

docs: add release note for DNS fallback SRV lookup panic fix 0.21.1

This commit is just a documentation update adding a release note for a previously fixed bug. The actual bug was a crash (panic) in LND's DNS fallback code: when looking up network routing information, the program assumed every answer from …

Denial of Service (daemon panic/crash) via DNS response manipulationUnsafe type assertion in DNS SRV lookup pathOut-of-bounds index access on empty LookupHost result
1ab34c4eby Erick Cestari+6−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
LL Lightning LabsLND BitcoinLightning Network

docs: remove release note for DNS fallback panic of 0.22.0

This commit only removes a sentence from the release notes document for version 0.22.0. It does not change any program code, so it cannot by itself introduce, fix, or alter a security vulnerability. The deleted text described a previously …

48ba0edfby Erick Cestari+0−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

multi: fix lint findings from btcd v2 migration

This commit is mostly a cleanup patch: it wraps long lines caused by a recent library rename and, importantly, adds a missing error check around a call that loads a Bitcoin transaction filter. The error check prevents a silent failure wher…

Previously unchecked error return now handledSilent failure in transaction filter update could lead to stale chain viewNo input validation, memory safety, or cryptographic changes present
39124289by Elle Mouton+46−144 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

apply note or pwd as b39 passphrase

This commit adds a new feature to the COLDCARD hardware wallet that lets users apply the text of a Secure Note or the value of a Secure Note password as their BIP-39 wallet passphrase. It also tightens how printable ASCII is checked in a f…

New feature exposes stored Secure Notes / Passwords as BIP-39 passphrasesInput validation relies on length, printable-ASCII, and rstrip of trailing whitespace/tab/newlineRefactored text sanitization changes control-flow for message signing and PSBT message warnings
0ef6413cby scgbckbone+223−289 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

multi: upgrade to btcd v2 modules

This is a large dependency upgrade for the LND Lightning node software. It moves LND from older btcd Bitcoin library packages to new 'v2' packages and updates related wallet and network libraries. The commit is almost entirely mechanical i…

Large dependency upgrade touching core Bitcoin primitives (wire, txscript, chainhash, btcutil, psbt, address)Migration to new v2 module layout with API changes in address handlingPins new upstream releases (btcd 0.26.0, btcwallet 0.17.0, neutrino 0.18.0, lightning-onion 1.4.0) that may include undisclosed fixes
8047149cby Oli+1733−1789605 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 73 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix BBQr share of Unicode text: encode str to UTF-8 before sizing/splitting

This commit fixes a bug in the COLDCARD Q1 hardware wallet where displaying certain QR codes containing non-English or special characters could cause the device to crash with an assertion failure. The fix ensures text is converted to UTF-8…

Assertion failure/crash in QR display pathLength mismatch between codepoints and UTF-8 bytesDenial-of-service-like symptom (device crash on user data display)
97d86c95by Dmitry Monakhov+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add groups for secure notes

This commit adds a new feature to the COLDCARD firmware that lets users organize their saved secure notes and passwords into groups, similar to folders. It is a user-experience improvement and does not fix or introduce any security vulnera…

edae8c1eby scgbckbone+345−183 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →