CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18168Commits captured
17444AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17444 analyses
Highest risk·RSS
Low 42 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

main: fix error handling during PIN change

This commit fixes a bug in the PIN-change flow on Blockstream Jade hardware wallets. Previously, if re-encrypting the wallet keys with a new PIN failed, or if the user abandoned the PIN change, the code did not jump to cleanup as intended.…

Missing error-path control flow in cryptographic key handlingPotential use of stale or partially initialized key material after PIN-change failureCleanup bypass in sensitive authentication code path
64c30823by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

main: fix error handling for debug handshake

This commit fixes a missing 'goto cleanup' after a failed attempt to save encrypted key data during a debug handshake. Without the fix, the code would continue running after reporting an error, potentially leaving sensitive key material in…

Missing error-path termination leading to fall-through after a security-critical failurePotential failure to clean up sensitive key material after flash storage errorAssertion on keychain state could be reached with inconsistent state
7fb5e90eby Mike Tolkachev+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

display: add check for screen power on status

This tiny change makes the device firmly check that the screen successfully powers on during startup, rather than silently continuing if something goes wrong. It is a defensive hardening fix, not a clear-cut vulnerability patch. The commit…

Unchecked return value now checked with JADE_ASSERTDefensive hardening in display initialization pathNo mention of vulnerability, exploit, or security issue in commit message
1883d343by Mike Tolkachev+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

log: gracefully ignore failed log printing

This commit hardens three logging functions so they stop immediately if formatting a log message fails, instead of continuing with a negative or zero length. Previously, a failed format could cause the code to pass an invalid length to net…

Defensive validation added to logging output pathsNegative length values no longer passed to socket/UART send functionsNo explicit security framing in commit message or diff
45897011by Jon Griffiths+12−51 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

main: check MAC address obtained successfully from efuse

This commit adds a safety check to ensure the device can read its unique hardware identifier (MAC address) from a special chip memory area (efuse) before continuing startup. Previously, the code read the MAC address but ignored whether it …

Unconditional failure handling added for security-relevant identifier readDevice-unique identity (MAC) now validated before useDefensive hardening of boot-time initialization
5ffaacc6by Mike Tolkachev+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

multisig: fix error handling

This commit fixes two error-handling bugs in Blockstream Jade's multisignature wallet code. In one case, an invalid multisig wallet record was detected but the function kept running instead of returning immediately, which could lead to usi…

Missing return after setting error condition in validation pathUnchecked return value from security-relevant path validationMultisignature wallet data integrity check bypass
427c2083by Mike Tolkachev+6−12 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

attestation: harden error handling of challenge signing

This commit fixes a bug in the Blockstream Jade hardware wallet's attestation signing process. Previously, if signing the attestation challenge failed, the device would send an error message but then continue running the rest of the functi…

Missing return after error path allows fall-through to success-path replyUninitialized output.ext_signature_len could leak stack data or cause undefined behaviorAttestation signing failure could result in sending an invalid attestation reply
ecc5871bby Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 39 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

attestation: fix missing cleanup on failed efuse write

This commit fixes a small but real bug in the device attestation setup code for Blockstream Jade, a hardware crypto wallet. When a one-time programmable security fuse failed to burn, the code used to exit immediately without releasing memo…

Missing cleanup on error path in security-critical initializationResource leak on failed efuse writePotential inconsistent attestation state after partial initialization
d37d88b7by Mike Tolkachev+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

descriptor: validate registered descriptors when re-loading them

This commit tightens validation when a Bitcoin hardware wallet reloads saved 'descriptors' (recipe-like data that describes how coins can be spent). It changes several length checks from 'greater than' to 'greater than or equal to', and ad…

Off-by-one length validation allowing buffer-filling inputMissing null-terminator safeguard on fixed-size string buffersUntrusted persisted data parsed without sufficient bounds checks
0aa7c99cby Mike Tolkachev+7−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BS BlockstreamBlockstream Jade BitcoinHardware wallets

build: update QEMU Docker container

This commit is a routine build-script maintenance change for the QEMU Docker container used to emulate the Jade hardware wallet. It merges two build commands into one so the ESP-IDF environment stays activated, and updates the container co…

05fc59d6by Mike Tolkachev+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

libjade: clear keychain on libjade_stop()

This change makes the Jade hardware wallet library wipe sensitive key material from memory when the library is stopped. Previously, stopping the library may have left private keys or seed data sitting in memory, which could be read by othe…

Sensitive memory not cleared on teardownKey material potentially left resident after library stopDefensive secret-zeroing patch
38a0e808by Daniel Newton+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

assets: fix unchecked fmemopen result

This commit fixes a bug where a memory-backed file handle could fail to open, but the code immediately tried to use and close it anyway. If opening failed, the program could crash or behave unpredictably when handling asset contract data o…

Unchecked fmemopen() return value (CWE-690 / CWE-476)Potential NULL pointer dereference in asset contract parsingResource cleanup conditional on successful allocation
b467fb5aby Mike Tolkachev+4−21 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →