CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18089Commits captured
17406AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17406 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): updates to English strings [no changelog]

This commit is a routine update to the English user-interface text strings in the Trezor firmware. It changes wording such as 'Continue with the next share' to 'Enter next share' and adjusts the line breaks in a few messages. There is no c…

aceafef6by Michal Kazda+7934−79343 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(l10n): updated fixtures

This commit only updates expected test-result fingerprints (hashes) in a JSON file used by the project's automated user-interface tests. No actual product code, firmware logic, or user-facing behavior was changed. It is a routine test-main…

c833b836by Michal Kazda+36−361 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

security: sync both security policy files

This commit only updates two security policy documents so they match each other. It reorders one contact entry, adds four missing team members to the second file, and fixes a small grammar note ('addresses' to 'address'). There are no code…

a20cc1c2by Lagrang3+8−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

ci: check that security and docs are synced

This commit adds a new automated CI check that verifies two security policy documents stay in sync. It does not change any runtime code, fix a bug, or alter security behavior. It is purely a process improvement for documentation consistenc…

c4e8c4f7by Lagrang3+6−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Return 0 on Target::from_compact overflow

This commit fixes a bug in how rust-bitcoin converts Bitcoin 'compact' difficulty targets into full numeric Target values. Previously, if the compact value encoded a number too large to fit in a valid Target, the code would silently produc…

Consensus-critical code path modifiedOverflow/wraparound in cryptographic/numeric conversionAlignment with Bitcoin Core behavior (SetCompact overflow flag)
1fb9a651by Mitchell Bagot+7−31 file
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 86 · Strong
BT btcsuitebtcd BitcoinNode implementations

btcutil: zero range-check scalar before returning from DecodeWIF

This commit adds a cleanup step in the function that decodes Bitcoin private keys from Wallet Import Format (WIF). It ensures a temporary mathematical value used to check the key is valid gets wiped from memory right after use, so the priv…

Sensitive-data lingering in local variable after useDefensive memory wipe added for private-key materialNo change to cryptographic validation or control flow
f10224ddby Lrifton92+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add one-shot hash method to HashEngine

This commit adds a small convenience method that lets any hash type compute a hash from a chunk of data in a single call. It is a pure API addition with no changes to existing behavior, no bug fixes, and no security-related content.

aa2050a2by jrakibi+10−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Restore lndhub support

This commit reverts a planned removal of LNDHub support by updating a single Lightning library version and editing the changelog. It is a feature restoration, not a security fix. There is no evidence in the commit of any vulnerability, exp…

cea07e5eby Nicolas Dorier+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

docs: Add user documentation

This commit only adds and reorganizes user and developer documentation. No program code, build scripts, tests, or cryptographic logic were changed. It is not a security patch and does not introduce or fix any vulnerability.

f32a3610by Salvatore Ingala+344−1654 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: cypherpunk build

This is a tiny build-fix commit for a special feature flag called 'cypherpunk'. It changes the default Rust feature set used by developers and adds a missing 'Vec' import for Zcash code. There is nothing in the diff that alters how user fu…

66939c74by soralit+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: remove duplicate SIG_BACKGROUND_UR_GENERATE_FAIL enumerator

This commit removes a duplicate entry in a list of internal software signal names used by the device's user interface. The duplicate would have caused the firmware to fail compilation, so the change is a straightforward build fix with no s…

1a8cfcb4by Adam Tucker+0−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: point ur-registry at upstream SDK rev

This commit simply switches a software dependency from a temporary community fork back to the project's own official upstream repository. The code being used is the same feature (Zcash batch registry support); it has just been merged into …

ef575e15by Adam Tucker+3−32 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →