Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

24Projects watched
18173Commits captured
17447AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17447 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 67 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_bumpfee.py

This commit changes a single test file to generate a random private key instead of using a hardcoded one. It is a test-only cleanup with no effect on the actual Bitcoin Core software users run.

ff3f6defby rkrux+4−21 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: use ExtendedPrivateKey in wallet_importdescriptors.py

This commit is a test-only cleanup. It replaces hardcoded example Bitcoin extended keys (xprv/xpub) and addresses in a functional test with freshly generated keys and programmatically derived addresses. There is no change to production wal…

f988e6d6by rkrux+69−371 file
No security note in commit
Informational 19 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnrpc: document reply_path verbatim passthrough on OnionMessageUpdate

This change is mostly documentation and a small code cleanup for LND's onion message streaming API. It clarifies that one field (the 'introduction_node' in a reply path) can arrive in two different formats: a regular 33-byte public key, or…

Documentation-only clarification of wire encoding for introduction_nodeNil reply path now returned as nil instead of empty struct (behavioral consistency)No input validation, parsing, or authorization changes
c5733c40by bitromortac+46−234 files
No security note in commit
Informational 21 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

rpc: add getopenrpcinfo command

This commit adds a new read-only RPC command called getopenrpcinfo to Bitcoin Core. It lets users ask the running node for a machine-readable catalog of all available RPC commands, similar to an API documentation page. The command does not…

New read-only RPC command added; no state mutation or consensus code touchedshow_hidden parameter can expose hidden RPC names and argument metadata to authenticated callersExisting RPC authentication and authorization layers still apply
672dd42dby will+452−05 files
No security note in commit
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add functional test for getopenrpcinfo

This commit only adds a new automated test that checks the output of an existing Bitcoin RPC command called getopenrpcinfo. It does not change any production code, wallet logic, networking, or consensus rules. There is no security issue he…

1fb6b605by will+98−02 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

rpc: factor getaddressinfo embedded field docs

This is a pure code cleanup change in Bitcoin Core's wallet RPC documentation. It moves repeated documentation fields for the getaddressinfo command into a shared helper function so the OpenRPC metadata and help text stay in sync. There is…

ef0676f4by will+10−101 file
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: remove libevent

This commit is a documentation cleanup. It removes libevent from build instructions and dependency lists because Bitcoin Core no longer uses libevent. It also updates a code comment in the wallet encryption file to remove an outdated refer…

146b3adfby fanquake+10−117 files
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

cmake: remove libevent

This commit removes libevent from the Bitcoin Core build system and deletes the associated helper header and unit tests. It is a dependency cleanup, not a security fix. There is no indication in the commit that this addresses a vulnerabili…

35d2d067by fanquake+0−2307 files
No security note in commit
Informational 19 AI analysisMessage 28 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

depends: remove libevent

This commit removes the libevent dependency from Bitcoin Core's build system ('depends'). It deletes the build recipe, patches, and references to libevent in makefiles and documentation. There is no direct code change to Bitcoin Core's run…

a0ca249fby fanquake+1−2117 files
No security note in commit
Informational 15 AI analysisMessage 40 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ci: remove libevent

This commit only changes the continuous integration (CI) setup scripts by removing the libevent library from the list of packages installed during automated testing. It does not modify any Bitcoin Core source code, runtime behavior, or net…

0443943dby fanquake+8−87 files
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

vcpkg: remove libevent

This commit removes the libevent dependency from Bitcoin Core's vcpkg package manager configuration. It is a build-system cleanup change, not a security fix. The removed override was previously pinning an older libevent version to avoid a …

96d7f55fby fanquake+2−101 file
No security note in commit
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this