CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18172Commits captured
17447AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17447 analyses
Highest risk·RSS
Informational 21 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/tools): fix `headertool_pq.py`

This commit fixes a developer tool used to prepare Trezor firmware images. Previously, the tool always signed firmware with internal 'dev keys' regardless of user intent. Now it only signs with dev keys when the user explicitly requests it…

Fixes unintended use of development-only signing keysDeveloper tooling bug, not runtime firmware vulnerabilityNo changelog entry provided by vendor
aa55ec2cby matejcik+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(python): introduce `NrfHeader` and `NrfImage`

This commit adds new Python code to the Trezor firmware tools for parsing and building Nordic Semiconductor (nRF) style firmware images. It is a feature addition, not a fix. The code handles firmware headers, TLV metadata blocks, SHA-256 d…

Adds Ed25519 signature verification for nRF firmware imagesAdds SHA-256 digest computation over header + image data + protected TLVAdds integrity checks on TLV table magics, protected TLV size, and trailer
af1a4b51by M1nd3r+388−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: share a single mocked steady clock across FuzzedSock instances

This change only affects Bitcoin Core's internal fuzz testing code. It makes several test mock sockets share a single fake clock instead of each having their own, so timing behaves more realistically during automated fuzz testing. There is…

6fa41322by Hao Xu+45−4011 files
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

refactor: cache Settings() namespace tree as a singleton

This commit is a performance refactor, not a security fix. It caches a single copy of the app's settings object tree so it doesn't rebuild ~16 objects every time code asks for Settings(). The actual setting values are still read fresh from…

0f28c9a7by odudex+17−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Add flash data backup scripts

This commit adds two helper scripts for developers to back up and restore BitBox02 flash memory areas using a Segger J-Link debugger. The scripts require physical hardware access and a debugging probe, and they are not part of the firmware…

285fa768by Niklas Dusenlund+383−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_taproot.py

This commit is a cleanup of a Bitcoin Core test file. It replaces a hard-coded list of test keys with a helper that generates fresh random keys during the test. There is no change to the actual Bitcoin node software, no fix for a vulnerabi…

8791c476by rkrux+12−1371 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_createwallet.py

This is a minor test-only cleanup. It replaces a hardcoded example private key in a Bitcoin Core functional test with a freshly generated one using a test helper. There is no change to production wallet code, no security fix, and no vulner…

4100fac2by rkrux+5−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_descriptor.py

This is a minor test-only change in Bitcoin Core. It replaces a hard-coded test private key with a freshly generated one for use in an automated functional test. There is no change to production wallet code, no security fix, and no vulnera…

06af0cddby rkrux+3−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_fundrawtransaction.py

This is a minor test-only cleanup. It replaces a hardcoded example private key in a test script with a freshly generated random one. There is no change to the actual Bitcoin Core software that users run, and no security vulnerability is be…

9e201187by rkrux+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_keypool.py

This commit only changes a single test file. It replaces hard-coded example private keys in a test script with freshly generated random keys produced by a helper class. There is no change to the actual Bitcoin Core wallet or node software,…

2ab6e590by rkrux+8−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_send.py

This commit changes only a test file. It replaces a hard-coded Bitcoin testnet extended private key with a freshly generated one using a test helper. There is no change to production wallet code, no bug fix, and no security-relevant behavi…

bbfffcabby rkrux+4−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_listdescriptors.py

This commit only changes a test file. It replaces hard-coded example Bitcoin keys with freshly generated random keys during automated testing. There is no change to the actual Bitcoin Core wallet software that users run, so it cannot affec…

89ceafafby rkrux+29−141 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →