CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16838Commits captured
7504AI analyses
60High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

7504 analyses
Highest risk·RSS
Informational 18 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

coldcard: fix get_soft_device_id() discarding its return value

This is a tiny one-line bug fix in Electrum's Coldcard hardware wallet plugin. A helper method that is supposed to fetch a software-based device identifier was calling the parent implementation but accidentally throwing away the result ins…

Missing return value causes method to always return NoneAffects hardware wallet device identification onlyNo change to signing, encryption, or authentication code
d7500508by Felipe Micaroni Lalli+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

2026-08-02 automated rustfmt nightly

This is an automated code-formatting commit from rustfmt. It only removes blank lines between imports and wraps one long function call across multiple lines. There are no security changes.

1aed04a9by Fmt Bot+3−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 73 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

changelog: add entry for #1821

This is a documentation-only commit that adds a changelog entry describing a previous code fix. The fix corrected a function in the ellswift module so it now rejects secret keys that are greater than or equal to the curve order, matching i…

Changelog entry describes a prior behavior change in secret-key handlingOld behavior silently reduced out-of-range keys modulo the curve orderVendor explicitly states old behavior is not a security issue
2076b06aby Sebastian Falbesoner+3−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 96 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

qml: strip whitespace from message before signing, as in qt gui

This commit fixes a minor consistency bug in Electrum's newer QML (mobile-style) user interface. When signing a message, the app now removes accidental spaces at the start or end of the message and address, just like the older desktop Qt i…

Behavioral inconsistency between GUI implementations could cause user confusion or failed verificationNo cryptographic weakness introduced; change is input normalizationNo memory-unsafe code, no privilege changes, no network changes
72507328by Ferdinando Ametrano+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: fix wrong transaction in GetP2SHSigOpCount assertion

This is a one-line fix inside a Bitcoin Core unit test. The test was checking the P2SH signature-operation count for the wrong transaction object: it used a transaction that still had its scriptSig, instead of the version where the scriptS…

test-only changeincorrect test assertion correctedno production consensus code modified
5559fa46by JP+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: Rework rpc fuzz target

This commit rewrites an internal fuzz-testing harness for Bitcoin Core's RPC interface. It changes how fake RPC arguments are generated so the test can feed more realistic JSON data (numbers, booleans, nested arrays/objects, raw JSON) dire…

No changes to runtime consensus, networking, wallet, or RPC server logicOnly src/test/fuzz/rpc.cpp is modifiedChange improves fuzzer fidelity by removing RPCConvertValues string-to-JSON conversion
fa895bb7by MarcoFalke+64−481 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: bind BBQr parts to the first part of the stream

This commit fixes Krux's QR code scanner so that when it reads a series of animated BBQr codes, every later frame must match the encoding and file type announced by the first frame, must agree on the total number of frames, and cannot over…

Input validation added for multi-part BBQr streamsMemory exhaustion mitigation via accumulated payload capAnti-splicing: parts must agree with first part's encoding and file type
0b3e01b7by odudex+86−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
KX KruxKrux BitcoinHardware wallets

docs: update CHANGELOG

This commit only updates the project's CHANGELOG.md file. It adds text describing several bug fixes and improvements that were apparently made in prior code changes, but no actual code is changed in this commit. By itself, this documentati…

4c05cefbby odudex+9−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

cautions, edit

This commit is a minor formatting edit to the README.md file. It changes a 'Security Advisory' heading from being displayed as a code block (with diff-style coloring) to a normal Markdown heading, and adds a horizontal rule. There are no c…

c849c4e0by Peter D. Gray+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Critical 100 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

cautions

This commit adds a security advisory to the COLDCARD firmware README. Coinkite states that firmware releases from 2021 through July 2026 contained a bug that produced weak randomness (poor entropy) when generating secrets such as wallet se…

Vendor self-disclosed security advisory in project READMEWeak/poor entropy in cryptographic secret generationAffected period spans multiple years (2021 to July 2026)
266f581aby Peter D. Gray+18−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 40 · Thin
KX KruxKrux BitcoinHardware wallets

chore(Maixpy): bump cUR

This commit appears to be a routine version bump of a component called 'cUR' inside the MaixPy firmware build. No actual code changes are visible in the provided diff, and the commit message gives no indication of a security fix or vulnera…

74d6ed40by odudex+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 18 · Opaque
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

upgrade protobuf

This commit relaxes the version requirement for the 'protobuf' Python library in the project's dependency files. It changes the requirement from 'exactly 4.23.3 or compatible updates' to 'any version 4.23.3 or newer'. This is a routine dep…

Dependency version constraint relaxed to allow newer protobuf versionsNo source code changes or vulnerability-specific patch evidenceNo CVE, advisory, or security-related references in commit or supplied materials
a7367506by andreasgriffin+2−22 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →