CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18157Commits captured
17438AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17438 analyses
Highest risk·RSS
Moderate 61 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

url: improve bounds checking

This commit tightens bounds checks in URL encoding/decoding functions used in Blockstream Jade, a hardware wallet. The changes fix potential off-by-one/out-of-bounds memory reads and writes when handling percent-encoded characters. Because…

Bounds-check rewrite in URL decoder to prevent out-of-bounds reads before percent-decodingCast to unsigned char moved into isxdigit() to avoid undefined behavior with signed char inputsDestination bounds checks in URL encoder changed from pointer-subtraction form to remaining-space form, mitigating possible underflow/wrap
c045aeacby Mike Tolkachev+5−71 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

qr: fix error handling for qr export

This commit fixes error handling in the QR-code backup feature of a hardware wallet. Previously, if generating QR fragments or scanning the verification QR failed, the code could continue with invalid data and wrongly tell the user the bac…

Unchecked return value from qrcode_toFragmentsIcons() could lead to use of uninitialized/invalid icon dataUnchecked return value from jade_camera_scan_qr() could allow a failed scan to be treated as a mismatch rather than an errorVerification flag could be set inconsistently if error paths were not clearly separated
5e9b791eby Jon Griffiths+4−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

sign_psbt: add early reject on wrong genesis blockhash

This commit fixes a bug in the Blockstream Jade hardware wallet's PSBT (Partially Signed Bitcoin Transaction) signing code. Previously, when the transaction's genesis block hash did not match the expected network, the code set an error mes…

Missing return in error path allows execution to continue after validation failureCross-network genesis hash mismatch not enforced as a hard failurePSBT signing logic accepts mismatched network parameters
56e130b0by Mike Tolkachev+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

descriptor: improve validation of child key path

This commit tightens how a Bitcoin hardware wallet (Blockstream Jade) validates the length of a child key path string before copying it into a fixed-size buffer. The change adds an explicit length check and uses the already-computed length…

Fixed-size buffer write (strcpy into signer->path_str)New explicit length assertion before copyDescriptor parsing path, a common attack surface for wallet firmware
2fad63e7by Mike Tolkachev+3−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

keychain: fix error handling for cached green service keys

This commit hardens error handling in a hardware wallet's key derivation code by wrapping two function calls with an assertion macro. Previously, if these functions failed silently, the device could continue with invalid or uninitialized c…

Unchecked return values from cryptographic key derivation functionsPotential use of invalid or uninitialized cached service keysAddition of fatal assertions on failure paths
15630d12by Jon Griffiths+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

main: ensure seed is present before completing OTP registration

This commit fixes a bug in the Blockstream Jade hardware wallet's one-time-password (OTP) registration feature. Previously, if no wallet seed existed, the device would log an error and show a reset message, but then accidentally continue w…

Missing error-path termination (fall-through after error reporting)State validation bypass possible before fixOTP secret persistence after seed-absence error
0d6536dfby Mike Tolkachev+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

main: fix error handling during PIN change

This commit fixes a bug in the PIN-change flow on Blockstream Jade hardware wallets. Previously, if re-encrypting the wallet keys with a new PIN failed, or if the user abandoned the PIN change, the code did not jump to cleanup as intended.…

Missing error-path control flow in cryptographic key handlingPotential use of stale or partially initialized key material after PIN-change failureCleanup bypass in sensitive authentication code path
64c30823by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

main: fix error handling for debug handshake

This commit fixes a missing 'goto cleanup' after a failed attempt to save encrypted key data during a debug handshake. Without the fix, the code would continue running after reporting an error, potentially leaving sensitive key material in…

Missing error-path termination leading to fall-through after a security-critical failurePotential failure to clean up sensitive key material after flash storage errorAssertion on keychain state could be reached with inconsistent state
7fb5e90eby Mike Tolkachev+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

display: add check for screen power on status

This tiny change makes the device firmly check that the screen successfully powers on during startup, rather than silently continuing if something goes wrong. It is a defensive hardening fix, not a clear-cut vulnerability patch. The commit…

Unchecked return value now checked with JADE_ASSERTDefensive hardening in display initialization pathNo mention of vulnerability, exploit, or security issue in commit message
1883d343by Mike Tolkachev+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

log: gracefully ignore failed log printing

This commit hardens three logging functions so they stop immediately if formatting a log message fails, instead of continuing with a negative or zero length. Previously, a failed format could cause the code to pass an invalid length to net…

Defensive validation added to logging output pathsNegative length values no longer passed to socket/UART send functionsNo explicit security framing in commit message or diff
45897011by Jon Griffiths+12−51 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

main: check MAC address obtained successfully from efuse

This commit adds a safety check to ensure the device can read its unique hardware identifier (MAC address) from a special chip memory area (efuse) before continuing startup. Previously, the code read the MAC address but ignored whether it …

Unconditional failure handling added for security-relevant identifier readDevice-unique identity (MAC) now validated before useDefensive hardening of boot-time initialization
5ffaacc6by Mike Tolkachev+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

multisig: fix error handling

This commit fixes two error-handling bugs in Blockstream Jade's multisignature wallet code. In one case, an invalid multisig wallet record was detected but the function kept running instead of returning immediately, which could lead to usi…

Missing return after setting error condition in validation pathUnchecked return value from security-relevant path validationMultisignature wallet data integrity check bypass
427c2083by Mike Tolkachev+6−12 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →