CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18157Commits captured
17438AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17438 analyses
Highest risk·RSS
Moderate 59 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Return 0 on Target::from_compact overflow

This commit fixes a bug in how rust-bitcoin converts Bitcoin 'compact' difficulty targets into full numeric Target values. Previously, if the compact value encoded a number too large to fit in a valid Target, the code would silently produc…

Consensus-critical code path modifiedOverflow/wraparound in cryptographic/numeric conversionAlignment with Bitcoin Core behavior (SetCompact overflow flag)
1fb9a651by Mitchell Bagot+7−31 file
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 86 · Strong
BT btcsuitebtcd BitcoinNode implementations

btcutil: zero range-check scalar before returning from DecodeWIF

This commit adds a cleanup step in the function that decodes Bitcoin private keys from Wallet Import Format (WIF). It ensures a temporary mathematical value used to check the key is valid gets wiped from memory right after use, so the priv…

Sensitive-data lingering in local variable after useDefensive memory wipe added for private-key materialNo change to cryptographic validation or control flow
f10224ddby Lrifton92+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: add one-shot hash method to HashEngine

This commit adds a small convenience method that lets any hash type compute a hash from a chunk of data in a single call. It is a pure API addition with no changes to existing behavior, no bug fixes, and no security-related content.

aa2050a2by jrakibi+10−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Restore lndhub support

This commit reverts a planned removal of LNDHub support by updating a single Lightning library version and editing the changelog. It is a feature restoration, not a security fix. There is no evidence in the commit of any vulnerability, exp…

cea07e5eby Nicolas Dorier+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

docs: Add user documentation

This commit only adds and reorganizes user and developer documentation. No program code, build scripts, tests, or cryptographic logic were changed. It is not a security patch and does not introduce or fix any vulnerability.

f32a3610by Salvatore Ingala+344−1654 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: cypherpunk build

This is a tiny build-fix commit for a special feature flag called 'cypherpunk'. It changes the default Rust feature set used by developers and adds a missing 'Vec' import for Zcash code. There is nothing in the diff that alters how user fu…

66939c74by soralit+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: remove duplicate SIG_BACKGROUND_UR_GENERATE_FAIL enumerator

This commit removes a duplicate entry in a list of internal software signal names used by the device's user interface. The duplicate would have caused the firmware to fail compilation, so the change is a straightforward build fix with no s…

1a8cfcb4by Adam Tucker+0−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: point ur-registry at upstream SDK rev

This commit simply switches a software dependency from a temporary community fork back to the project's own official upstream repository. The code being used is the same feature (Zcash batch registry support); it has just been merged into …

ef575e15by Adam Tucker+3−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Add Zcash batch signing for shielded PCZTs

This commit adds a new Zcash batch-signing feature for shielded transactions and fixes a UI bug where Zcash signing could freeze if the response QR code could not be generated. The changes introduce new Rust code to validate, parse, and si…

New batch signing path for Zcash shielded PCZTs with 35-message limitAtomic batch semantics: any invalid message aborts the whole batchPreflight check `ensure_pczt_has_signable_shielded_action` prevents silent no-signature results
745330f6by Adam Tucker+2201−5232 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: bump beta version

This commit only changes a software version number in a header file, lowering the minor version from 12.5.0 to 12.4.9 and keeping the beta flag. There is no functional code change and no security relevance visible in the diff.

4e28d917by soralit+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

logging: More fully remove libevent log category

This commit is a routine cleanup after Bitcoin Core replaced its old HTTP server (libevent). It removes the 'libevent' logging category from help text, RPC output, and internal code. Users who still try to use it will get a deprecation war…

3765b428by Ryan Ofsky+42−465 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Fix flaky test

This commit fixes a flaky automated test for the global search feature. The JavaScript change makes the search run automatically if a query is already present when the search UI opens, and the test code is simplified to remove a special sc…

23219bc9by Nicolas Dorier+3−92 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →