CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18168Commits captured
17444AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17444 analyses
Highest risk·RSS
Informational 12 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

SIGHASH gating: unit tests

This commit only adds new automated unit tests for an existing function called classify_sighash. It does not change any production wallet code, fix a bug, or alter behavior. The tests verify that different Bitcoin signature-hash types are …

Tests codify a security-relevant policy decision (safe vs. non-safe vs. unsupported sighash types)No change to production code, attack surface, or cryptographic handlingNo bug fix, bounds check, or input validation change present in diff
d89aa8b5by Ilya Artemov+112−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 35 · Opaque
LD LedgerLedger Bitcoin app BitcoinHardware wallets

SIGHASH gating: implementation

This commit adds a user-controlled setting to the Ledger Bitcoin app that blocks non-standard Bitcoin transaction signing modes by default. Previously, these modes were allowed with only a warning. Now the app rejects them unless the user …

Adds default-deny gate for non-standard Bitcoin sighash typesIntroduces persistent NVRAM setting for security-relevant behaviorAdds explicit warning confirmation dialog before enabling risky setting
296bed60by Ilya Artemov+220−116 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 78 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Reject witness-only UTXO for legacy inputs; Suppress fee for unverified witness UTXOs;normalize legacy inputs to proper utxo

This update fixes a bug in the COLDCARD hardware wallet where a malicious or malformed Bitcoin transaction file (PSBT) could trick the device into using the wrong amount of money for a non-SegWit (legacy) input. Specifically, if the file o…

Fixes legacy input amount spoofing via witness-only UTXORejects PSBT inputs that provide only PSBT_IN_WITNESS_UTXO for non-SegWit inputs the device must signPrefers full non_witness_utxo over witness_utxo when both are present
59eb529aby scgbckbone+224−656 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(python): remove `magic` and `code_length` fields from `LegacyFirmware` struct

This is a small internal cleanup in the Python helper library that handles Trezor One firmware files. It removes two exposed fields ('magic' and 'code_length') from a Python class and renames them to private internal names ('_magic' and '_…

163c927cby M1nd3r+3−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): remove unused strings - one form tests as well [no changelog]

This commit is a routine cleanup of unused text strings used in the Trezor device's user interface. It removes several translation entries that are no longer referenced anywhere in the code, and updates the generated translation tables acc…

7b11122fby Michal Kazda+11140−111695 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): updated blanking rules [no changelog]

This commit only updates a JSON file that lists which on-screen text strings are allowed to be blank (untranslated) for specific Trezor device layouts. It adds and reorganizes translation-key rules. There is no change to firmware code, cry…

d34305beby Michal Kazda+27−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): applied blanking rules [no changelog]

This commit is a routine translation update. It changes which on-screen text strings are shown for different product styles (Bolt, Caesar, Delizia, Eckhart), leaving some styles blank where the text is not needed. There is no code behavior…

d258ecf1by Michal Kazda+10851−107562 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): applied blanking rules [no changelog]

This commit is a routine translation maintenance change. It updates the device's internal translation tables so that some text strings are intentionally left blank in certain languages, following a project's 'blanking rules' file. There is…

8d81ec28by Michal Kazda+7496−74913 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Reject non-pushnum opcodes in multisig pattern

This commit fixes a bug in how the library decides whether a Bitcoin script is a classic 'multisig' script. Before the fix, the final opcode that states how many public keys are required could be something other than a normal number-pushin…

Script pattern validation bypassMultisig classification bugNon-canonical opcode accepted as valid push number
219d68eaby Abeeujah+10−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Use let-else to flatten nested optionals in is_multisig

This commit is a pure code-style refactor. It rewrites the same multisignature-pattern check using a newer Rust syntax (let-else) that flattens nested if-let blocks. The author explicitly states there are no behavioral changes, and the dif…

3f1ae4caby Abeeujah+7−161 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

improve USB validation

This commit tightens input-length checks for commands that COLDCARD receives over its USB interface. Before the change, several commands would accept packets that were too short, too long, or internally inconsistent. That could let a malic…

Adds length/bounds assertions to USB command parsersPrevents trailing bytes after fixed-length command payloadsPrevents short/under-length command payloads from being processed
d5aba396by scgbckbone+310−234 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 83 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Adjust Transaction arbitrary to satisfy decode checks

This commit fixes a fuzz-testing helper so that randomly generated fake Bitcoin transactions follow the same rules that the real transaction decoder enforces. It does not change normal transaction handling, network behavior, or wallet logi…

Fuzz-only code pathAlignment of arbitrary generator with existing decoder invariantsNo change to consensus-critical decode/validation logic
1357c3c9by Mitchell Bagot+31−61 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →