CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17983Commits captured
17344AI analyses
102High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17344 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 77 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

security: sync both security policy files

This commit only updates two security policy documents so they match each other. It reorders one contact entry, adds four missing team members to the second file, and fixes a small grammar note ('addresses' to 'address'). There are no code…

a20cc1c2by Lagrang3+8−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

ci: check that security and docs are synced

This commit adds a new automated CI check that verifies two security policy documents stay in sync. It does not change any runtime code, fix a bug, or alter security behavior. It is purely a process improvement for documentation consistenc…

c4e8c4f7by Lagrang3+6−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Return 0 on Target::from_compact overflow

This commit fixes a bug in how rust-bitcoin converts Bitcoin 'compact' difficulty targets into full numeric Target values. Previously, if the compact value encoded a number too large to fit in a valid Target, the code would silently produc…

Consensus-critical code path modifiedOverflow/wraparound in cryptographic/numeric conversionAlignment with Bitcoin Core behavior (SetCompact overflow flag)
1fb9a651by Mitchell Bagot+7−31 file
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 86 · Strong
BT btcsuitebtcd BitcoinNode implementations

btcutil: zero range-check scalar before returning from DecodeWIF

This commit adds a cleanup step in the function that decodes Bitcoin private keys from Wallet Import Format (WIF). It ensures a temporary mathematical value used to check the key is valid gets wiped from memory right after use, so the priv…

Sensitive-data lingering in local variable after useDefensive memory wipe added for private-key materialNo change to cryptographic validation or control flow
f10224ddby Lrifton92+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add one-shot hash method to HashEngine

This commit adds a small convenience method that lets any hash type compute a hash from a chunk of data in a single call. It is a pure API addition with no changes to existing behavior, no bug fixes, and no security-related content.

aa2050a2by jrakibi+10−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Restore lndhub support

This commit reverts a planned removal of LNDHub support by updating a single Lightning library version and editing the changelog. It is a feature restoration, not a security fix. There is no evidence in the commit of any vulnerability, exp…

cea07e5eby Nicolas Dorier+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

docs: Add user documentation

This commit only adds and reorganizes user and developer documentation. No program code, build scripts, tests, or cryptographic logic were changed. It is not a security patch and does not introduce or fix any vulnerability.

f32a3610by Salvatore Ingala+344−1654 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: cypherpunk build

This is a tiny build-fix commit for a special feature flag called 'cypherpunk'. It changes the default Rust feature set used by developers and adds a missing 'Vec' import for Zcash code. There is nothing in the diff that alters how user fu…

66939c74by soralit+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: remove duplicate SIG_BACKGROUND_UR_GENERATE_FAIL enumerator

This commit removes a duplicate entry in a list of internal software signal names used by the device's user interface. The duplicate would have caused the firmware to fail compilation, so the change is a straightforward build fix with no s…

1a8cfcb4by Adam Tucker+0−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: point ur-registry at upstream SDK rev

This commit simply switches a software dependency from a temporary community fork back to the project's own official upstream repository. The code being used is the same feature (Zcash batch registry support); it has just been merged into …

ef575e15by Adam Tucker+3−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Add Zcash batch signing for shielded PCZTs

This commit adds a new Zcash batch-signing feature for shielded transactions and fixes a UI bug where Zcash signing could freeze if the response QR code could not be generated. The changes introduce new Rust code to validate, parse, and si…

New batch signing path for Zcash shielded PCZTs with 35-message limitAtomic batch semantics: any invalid message aborts the whole batchPreflight check `ensure_pczt_has_signable_shielded_action` prevents silent no-signature results
745330f6by Adam Tucker+2201−5232 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: bump beta version

This commit only changes a software version number in a header file, lowering the minor version from 12.5.0 to 12.4.9 and keeping the beta flag. There is no functional code change and no security relevance visible in the diff.

4e28d917by soralit+2−21 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →