Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

24Projects watched
18176Commits captured
17449AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17449 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 60 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: connman: cover AddLocalServices/RemoveLocalServices

This commit adds new test code to Bitcoin Core's fuzzing harness for the network connection manager. It exercises the AddLocalServices and RemoveLocalServices functions, which control what network service flags a node advertises. The chang…

1a3cfdf1by Bruno Garcia+16−01 file
No security note in commit
Informational 15 AI analysisMessage 75 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: connman: add AddNode/RemoveAddedNode invariants

This commit only changes a fuzz test file. Fuzz tests are automated tools that throw random inputs at code to find bugs. It adds checks that verify how Bitcoin Core's connection manager handles manually added nodes. There is no change to p…

4a6fce43by Bruno Garcia+20−51 file
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

docs: NFC antenna by HW

This commit only updates user documentation and adds a diagram showing where the NFC antenna is located on different Coldcard hardware models (Mk4, Mk5, Q1). It also updates instructions for physically disabling the NFC antenna on each mod…

755353f0by scgbckbone+19−52 files
No security note in commit
Low 26 AI analysisMessage 57 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

build: automatic block height update

This commit automates how the COLDCARD firmware records the latest Bitcoin block height during the build process. It fetches the current block height from two public Bitcoin explorer websites (mempool.space and blockstream.info) and stores…

New build-time network dependency fetching data from two third-party APIsFetched value is compiled into firmware and used as a consensus/security parameter (ccc_min_block)No cryptographic verification of the fetched block height (HTTP only, no signature checks)
2981d159by scgbckbone+110−66 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Simplify ChannelUnavailable APIError handling with let-else

This is a pure code cleanup that rewrites an awkward nested match statement into a newer, more idiomatic Rust construct called let-else. It does not change what the program does, what data it accepts, or how it responds to errors. There is…

e9e3060bby Abeeujah+5−201 file
No security note in commit
Informational 13 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: Remove unnecessary thread pool mutexes

This commit removes mutexes (thread-safety locks) from two internal Bitcoin Core fuzz-test helpers. Fuzz tests are automated test harnesses, not production code, and the commit explains that the locks were unnecessary because fuzz targets …

Change is confined to fuzz-test harness code (src/test/fuzz/*)Removal of synchronization primitives in non-production test codeCommit message explicitly states the mutexes were unnecessary for the fuzzing execution model
48df0939by marcofleon+4−82 files
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: Speed up dbwrapper_concurrent_reads harness

This commit only changes a fuzz test (an automated testing harness) for Bitcoin Core's database wrapper. It reduces how many read operations each simulated worker thread performs during the test, which makes the test run faster, and increa…

a4c3b003by marcofleon+7−21 file
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): cleanup display panel selection

This commit is a straightforward internal cleanup that moves display panel definitions from individual device header files into a central build script. It does not change what the code does, only where the settings are declared. There is n…

667b942dby tychovrahe+4−158 files
No security note in commit
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): refactor panel selection for touch driver

This commit is a straightforward internal cleanup of how Trezor firmware chooses touch-screen hardware drivers and matching touch-panel correction data. It splits a single combined setting into separate 'driver' and 'panel' settings, simil…

eed12338by tychovrahe+71−1811 files
No security note in commit
Low 29 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/xtask): place combined sections at their flash offsets

This commit fixes a bug in the tool that builds Trezor hardware wallet flash images. Previously, when combining the boardloader, bootloader, and firmware into one file, later sections were placed too early because earlier files were smalle…

Incorrect binary layout could produce unbootable or misaligned firmware imagesBuild-time tooling bug with potential reliability/integrity implications for shipped imagesNo runtime exploit primitive visible in the diff
534df742by tychovrahe+105−141 file
No security note in commit
Low 36 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: reserve walletrescan before checking wallet is at the tip

This small change reorders two operations in the `importdescriptors` wallet command. Previously, the wallet first waited until it was caught up to the latest block, then tried to reserve a rescan. Now it reserves the rescan first, then wai…

TOCTOU/race-condition hardening in wallet rescan reservationReordering of synchronization and lock acquisitionWallet RPC importdescriptors behavior change
336f5a73by Pol Espinasa+4−41 file
No security note in commit
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this