CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18157Commits captured
17438AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17438 analyses
Highest risk·RSS
Low 35 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

wire: explicitly set nonblocking default to false

This commit fixes a small but real bug in Blockstream Jade's USB/serial message handling. A variable that decides whether a version-info message should get an immediate reply was not given a safe starting value. In C, that means it could a…

Use of uninitialized local variable (CWE-457)Potential logic bypass in immediate-message handlingDefensive initialization hardening
3d28dccbby Jon Griffiths+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

libjade: use existing frame buffer rectangle drawing

This commit removes a custom bitmap-drawing function used only in the libjade build and makes that build use the same drawing path as other configurations. It is a code cleanup with no visible security relevance.

ff0789f0by Jon Griffiths+0−253 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

tools: don't attempt to overwrite kconfig if checking fails

This is a small fix to a developer helper script (format.sh) used during code formatting. It prevents the script from trying to move a temporary file into place when a configuration-file check fails or never creates that temporary file. Th…

No security-relevant signal in the diffChange is in a build/development helper script, not firmware logic, cryptography, or network handling
3dd9c4dbby Jon Griffiths+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 62 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

build: add build support for enforcing return codes are checked

This commit adds compiler flags and helper macros to make the build fail whenever a function's return value is ignored without explicit intent. It is a hardening change, not a fix for a specific known bug. By enforcing that programmers che…

Compiler hardening flag added (-Werror=unused-result)New macros to annotate and explicitly ignore function return valuesNo specific vulnerable call site patched in this commit
bb2e53d6by Mike Tolkachev+21−03 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 74 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

build: annotate functions returning error codes to ensure they are checked

This commit is a preventive build-hardening change. It adds compiler annotations (WARN_UNUSED_RESULT) to many functions that return success/failure codes, so the compiler will warn if a caller ignores the result. The goal is to catch futur…

Compiler annotation added to enforce checking of error-returning functionsNo specific vulnerability fixed in the diffNo functional code changes or call-site fixes included
909a89aaby Mike Tolkachev+215−15225 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

assets: explicitly allow precision field to be optional

This small change makes the 'precision' number in asset metadata optional, defaulting to 0 if missing. Previously, the code may have treated a missing precision field as a failure. The patch uses a wrapper that explicitly ignores any error…

Use of IGNORE_RESULT macro suppresses return-value checkingOptional field handling change in asset contract parsingPotential masking of CBOR parsing errors for precision field
36f997b9by Mike Tolkachev+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

otp: show error on invalid issuer, share logging strings

This commit tightens error handling when decoding the 'issuer' field of an OTP (one-time password) setup URI. Previously, a malformed issuer string could fail to decode silently; now the device shows an error and cancels the operation inst…

Input validation added for OTP URI issuer fieldSilent failure on malformed URL-decoding replaced with explicit error returnDebug assertion added for label/issuer URL-decoding in UI display path
66c945f2by Mike Tolkachev+9−52 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 28 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

psbt: fix path size

This commit fixes a small but meaningful bug in how Jade, a hardware wallet, reads key paths from Bitcoin PSBT data. The code was passing the byte size of a buffer when it should have passed the number of 32-bit entries. Depending on how t…

Buffer-size semantic mismatch in security-critical PSBT parsingUse of sizeof() on uint32_t array where element count is expectedCode path involved in 2of3 multisig recovery key identification
9e0c3747by Mike Tolkachev+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

identity: add identity string validation

This commit adds a safety check to Blockstream Jade's 'sign identity' feature. Before the change, the device would accept any identity string a connected app sent. Now it rejects identities that contain non-printable or unusual characters.…

Input validation added to a signing/identity processNew length-bounded string helper reduces reliance on null-terminationRejection of non-printable characters in user-presented identity string
53752b98by Mike Tolkachev+22−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

usb: remove unused return from usb top level actions

This commit is a minor code cleanup in the USB storage feature of the Blockstream Jade hardware wallet. It changes two functions so they return nothing (void) instead of a true/false value, because the returned value was never actually use…

2ff2b31dby Jon Griffiths+7−72 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

utils: fix params_additional_info return type

This commit changes the declared return type of a transaction-signing helper function from a transaction-type code (TxType_t) to a simple success/fail boolean (bool). The function body already appears to return true/false, so the change fi…

Return-type mismatch between function declaration/definition and headerFunction is in transaction-signing utility code (sign_utils.c/h)Function handles CBOR transaction parameters and writes output transaction metadata
3d6cdbcbby Jon Griffiths+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

sign: match sign_tx logic for output commitment checking

This commit fixes a logic gap in how Blockstream Jade checks cryptographic commitments for transaction outputs during signing. Previously, the code treated a missing commitment the same as an invalid one, which could cause the device to re…

Inconsistent commitment validation between signing code pathsPossible transaction signing failure or acceptance of unvalidated output commitmentsLogic alignment with existing sign_tx commitment handling
be05deacby Jon Griffiths+5−21 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →