CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18176Commits captured
17449AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17449 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core): add N4W1-based fixtures to reset/recovery device tests

This commit only updates automated test scripts and recorded test snapshots (fixtures) for the Trezor firmware. It adds support for testing a new backup method called N4W1 alongside the existing on-screen display backup method. There are n…

388c3ec0by Roman Zeyde+385−3047 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 85 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

swaps: cache SwapData in self._swaps instead of accessing storage

This change is a bug-fix-style refactor for Electrum's submarine swap feature. It separates in-memory cached swap data from data saved to disk, so temporary fields used while a swap is running don't get lost or behave inconsistently when t…

State inconsistency between in-memory object and on-disk storageTemporary/private fields assumed persistent across storage accessRefactor that removes direct mutation of persistent dict from indexing logic
d8ff8305by ThomasV+24−131 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 45 · Thin
LL Lightning LabsLND BitcoinLightning Network

rpcperms: recover RPC handler panics

This commit adds a safety net around LND's RPC handlers so that if a handler crashes (panics), the entire lnd process is no longer taken down. Instead, the crash is caught, logged with a stack trace, and the caller receives a generic 'inte…

Adds panic recovery at the RPC boundary to prevent process crashes from handler bugsConverts unhandled panics into gRPC Internal errors, improving availabilityLogs recovered panics with stack traces for forensics
4bbfcab9by yyforyongyu+281−12 files
No security note in commit
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

WIF Store upgrade

This commit upgrades the COLDCARD firmware's WIF Store feature so that individual private keys imported as WIF can sign transactions even when the PSBT file lacks the usual BIP-32 key-path metadata. It adds address/scriptPubKey auto-detect…

Signing path now accepts PSBT inputs with no BIP-32 derivation data if a matching WIF-store pubkey is foundSynthetic subpaths with zero fingerprint are injected for WIF-matched inputsRemoved assertion that key paths must be at least depth 8 (vl >= 8)
1dddd885by scgbckbone+717−849 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

repro: add automake as explicit dependency

This commit adds the 'automake' package to three Ubuntu Dockerfiles used for reproducible builds. It is a build-system maintenance fix: newer Ubuntu versions no longer pull in automake automatically, which caused builds to fail because a t…

b7491a06by daywalker90+35−323 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

BIP-322 changes after BIP got in to the complete state

This commit updates COLDCARD's BIP-322 (Bitcoin message signing / proof-of-reserves) implementation to match the finalized BIP-322 specification. The main user-visible change is that the message to be signed must now be embedded directly i…

BIP-322 message now embedded in PSBT and verified against reconstructed to_spend, reducing reliance on external/user-supplied message filesBIP-322 PSBTs are explicitly prevented from being finalized into broadcastable transactionsHSM policy now applies message-signing path restrictions to BIP-322 PSBTs
d656f371by scgbckbone+1106−61015 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Restore borrowed secret handling in SensitiveValues

This commit removes one line of code that was adding a secret value to an internal tracking list called 'spots' inside the COLDCARD firmware's sensitive-data handling. The title says it 'restores borrowed secret handling,' suggesting the p…

Removal of sensitive-value tracking registrationChange touches secret-handling / stash codeCommit title frames change as restoring correct borrowed-secret semantics
7e92e516by scgbckbone+0−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

stabilize tests

This commit only changes test files in the COLDCARD firmware repository. It adds setup steps (like returning to the home screen before tests), updates menu navigation to match renamed menu items, and makes test assertions more flexible. Th…

74d34cfcby scgbckbone+69−555 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

simulator:attribute catchup with real SCAN

This commit makes two small, unrelated tweaks to the Coldcard simulator. One adds copy-and-paste keyboard shortcuts to the simulator's terminal window. The other adds a missing 'busy_scanning' flag to the simulated QR-code scanner so it be…

64658621by scgbckbone+13−12 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 78 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Read chunks via typed pointers

This commit changes how the BitBox02 firmware reads sensitive stored data (device name, seed birthdate, encryption keys, BLE identity, etc.). Previously, the firmware copied whole chunks from flash into RAM and then cleared them afterward.…

Removal of RAM zeroization (util_zero/CLEANUP_CHUNK) for many secret-bearing chunk readsDirect flash-mapped typed pointers now used for sensitive fields in production buildsOne hardening fix: device_name copy now uses bounded '%.*s' instead of unbounded '%s'
e21bd6feby Niklas Dusenlund+164−1432 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Disable ASLR for unit tests

This commit changes how the project's automated unit tests are run. It disables Address Space Layout Randomization (ASLR) only during testing, when available, by wrapping the test command with setarch -R. ASLR randomizes where programs are…

a8b013ccby Niklas Dusenlund+5−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): update UI fixtures

This commit only updates expected visual test fingerprints (hashes) for Solana message-signing tests across multiple languages and device models. No actual firmware code, user interface logic, or security behavior was changed. It is a rout…

021c1de2by Roman Zeyde+40−401 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →