CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17983Commits captured
17340AI analyses
102High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17340 analyses
Highest risk·RSS
Moderate 58 AI analysisMessage 62 · Adequate
LL Lightning LabsLND BitcoinLightning Network

docs: add release note for DNS fallback SRV lookup panic fix 0.21.1

This commit is just a documentation update adding a release note for a previously fixed bug. The actual bug was a crash (panic) in LND's DNS fallback code: when looking up network routing information, the program assumed every answer from …

Denial of Service (daemon panic/crash) via DNS response manipulationUnsafe type assertion in DNS SRV lookup pathOut-of-bounds index access on empty LookupHost result
1ab34c4eby Erick Cestari+6−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
LL Lightning LabsLND BitcoinLightning Network

docs: remove release note for DNS fallback panic of 0.22.0

This commit only removes a sentence from the release notes document for version 0.22.0. It does not change any program code, so it cannot by itself introduce, fix, or alter a security vulnerability. The deleted text described a previously …

48ba0edfby Erick Cestari+0−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

multi: fix lint findings from btcd v2 migration

This commit is mostly a cleanup patch: it wraps long lines caused by a recent library rename and, importantly, adds a missing error check around a call that loads a Bitcoin transaction filter. The error check prevents a silent failure wher…

Previously unchecked error return now handledSilent failure in transaction filter update could lead to stale chain viewNo input validation, memory safety, or cryptographic changes present
39124289by Elle Mouton+46−144 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

apply note or pwd as b39 passphrase

This commit adds a new feature to the COLDCARD hardware wallet that lets users apply the text of a Secure Note or the value of a Secure Note password as their BIP-39 wallet passphrase. It also tightens how printable ASCII is checked in a f…

New feature exposes stored Secure Notes / Passwords as BIP-39 passphrasesInput validation relies on length, printable-ASCII, and rstrip of trailing whitespace/tab/newlineRefactored text sanitization changes control-flow for message signing and PSBT message warnings
0ef6413cby scgbckbone+223−289 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

multi: upgrade to btcd v2 modules

This is a large dependency upgrade for the LND Lightning node software. It moves LND from older btcd Bitcoin library packages to new 'v2' packages and updates related wallet and network libraries. The commit is almost entirely mechanical i…

Large dependency upgrade touching core Bitcoin primitives (wire, txscript, chainhash, btcutil, psbt, address)Migration to new v2 module layout with API changes in address handlingPins new upstream releases (btcd 0.26.0, btcwallet 0.17.0, neutrino 0.18.0, lightning-onion 1.4.0) that may include undisclosed fixes
8047149cby Oli+1733−1789605 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 73 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix BBQr share of Unicode text: encode str to UTF-8 before sizing/splitting

This commit fixes a bug in the COLDCARD Q1 hardware wallet where displaying certain QR codes containing non-English or special characters could cause the device to crash with an assertion failure. The fix ensures text is converted to UTF-8…

Assertion failure/crash in QR display pathLength mismatch between codepoints and UTF-8 bytesDenial-of-service-like symptom (device crash on user data display)
97d86c95by Dmitry Monakhov+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add groups for secure notes

This commit adds a new feature to the COLDCARD firmware that lets users organize their saved secure notes and passwords into groups, similar to folders. It is a user-experience improvement and does not fix or introduce any security vulnera…

edae8c1eby scgbckbone+345−183 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Pin zeroize for old Rust CI

This commit only changes a CI script to pin a dependency version so older Rust toolchains can still build the project. It is a build-maintenance fix with no security relevance.

a8a4767fby Joost Jager+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): optimize size of build artifacts

This commit adjusts build settings to make compiled helper programs and build outputs smaller. It strips debug symbols, reduces optimization for size, and changes the debug-info flag for C code from detailed to basic. There is no indicatio…

02927b49by cepetr+20−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

test_storage_upgrade: add test wallet with invoice and request

This commit only adds a new test case and a test wallet file to Electrum's test suite. It does not change any production code, so it cannot introduce a security vulnerability or fix one. The test wallet contains a publicly exposed seed phr…

4774f7adby ThomasV+147−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix QR scanner setup and sleep handling

This commit fixes several bugs in how the COLDCARD Q1 hardware wallet talks to its built-in QR-code scanner. The changes make scanner startup more reliable, prevent stale 'go to sleep' commands from accidentally stopping a scan that just s…

Hardware peripheral reset line held in asserted state (potential wake/power issue)Async sleep command could race with newly started scan (state-management bug)CancelledError from asyncio.wait_for_ms could strand setup task
ad2088d2by scgbckbone+163−693 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Keep scanner reinit state instance-local

This tiny code change moves a 'needs reinit' flag from being shared across all QR scanner objects to being kept inside each individual scanner object. In the real device code the flag is removed from the base class; in the simulator it is …

Shared mutable class-level state removedState variable made instance-localPotential race-condition / state-confusion class eliminated
55340577by scgbckbone+1−22 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →