CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16840Commits captured
7504AI analyses
60High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

7504 analyses
Highest risk·RSS
Informational 11 AI analysisMessage 28 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

u2f: fix refresh screen

This commit fixes a UI cleanup bug in the BitBox02 hardware wallet's U2F (Universal 2nd Factor) feature. Previously, a 'Refresh webpage' screen could be destroyed without clearing the pointer that tracked it, potentially leaving a dangling…

dangling-pointer mitigationuse-after-free preventionfirmware UI state cleanup
890f4ce3by benma's agent+17−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
KX KruxKrux BitcoinHardware wallets

chore: bump version to 26.08.0

This commit is a routine version bump from 26.04.0 to 26.08.0. It only updates version strings in documentation, build files, and source metadata. No code behavior changes. The changelog text mentions a previously fixed heap buffer overflo…

Changelog references a prior heap buffer overflow in Shannon entropy module (camera frame copy into fixed 320x240 RGB565 buffer)No actual code or security fix present in this commit
dea991dfby odudex+5−55 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: register embed_fire in the bdftokff device list

This commit fixes a build-time font-generation script so that a newly supported device ('embed_fire') is recognized. Before the fix, the script printed an error but still produced the same font files. There is no security issue.

f15308e4by odudex+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 2 AI analysisMessage 57 · Thin
KX KruxKrux BitcoinHardware wallets

chore: bump MaixPy with updated glyphs

This commit appears to update a submodule or dependency called MaixPy to a newer version that includes updated visual glyphs (small icons/symbols). The title and message describe it as a routine maintenance chore, not a security fix. No ac…

a9329228by odudex+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 57 · Thin
KX KruxKrux BitcoinHardware wallets

docs: add PSBT input amount fixes to CHANGELOG

This commit only updates the project's CHANGELOG.md to document earlier fixes related to PSBT (Partially Signed Bitcoin Transaction) fee and amount handling. It does not contain any code changes itself. The changelog entries describe secur…

Changelog documents prior PSBT fee/amount validation fixesMentions insufficient coordinator data as a security concernNo actual code or test changes in this commit
48920c31by odudex+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 78 AI analysisMessage 95 · Strong
KX KruxKrux BitcoinHardware wallets

fix: verify PSBT input amounts before showing the fee

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify …

Fixes fee-display/sighash amount mismatchAdds prevout txid hash verification for non_witness_utxoMandates non_witness_utxo for legacy inputs
fc808059by odudex+353−122 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: render negative amounts correctly in format_btc

This commit fixes a display bug in how Krux formats negative Bitcoin amounts. Previously, a value like -1000 satoshis was shown incorrectly as roughly -1.99 bitcoins instead of -0.00001 bitcoins, because the code split the number before ha…

UI/display bug in financial amount renderingNo cryptographic, authorization, or memory-safety changesNo input validation, parsing, or serialization of untrusted data changed
c7e48ae1by odudex+22−12 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: reject a PSBT whose outputs exceed its inputs

This commit fixes a bug in Krux, a Bitcoin signing device, where a malformed transaction whose outputs spend more than its inputs could be loaded and shown to the user. Normally such a transaction is impossible on the Bitcoin network, but …

Input validation gap in PSBT parsingUI rendering bug masking invalid transaction economicsPotential social-engineering / user-confusion attack
d6813d88by odudex+52−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

feat: warn when PSBT input amounts cannot be verified

This commit adds a warning screen to Krux, a hardware signing device, when it is asked to sign a multi-input Bitcoin transaction where the amounts of some inputs cannot be independently verified. The risk is that a malicious transaction co…

New user-facing warning for unverified multi-input SegWit amountsDetection logic tied to BIP143 signature semantics and inp.is_verifiedDoes not enforce previous-transaction inclusion; user can still proceed
518b3314by odudex+159−24 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
KX KruxKrux BitcoinHardware wallets

i18n: translate the unverified input amounts warning

This commit only adds translations for two existing warning messages in the Krux Bitcoin hardware wallet software. It does not change any code logic, security behavior, or fix any vulnerability. The messages warn users that displayed fees …

bdaed1a1by odudex+46−023 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 53 AI analysisMessage 62 · Adequate
KX KruxKrux BitcoinHardware wallets

docs: add Maix Bit removal and Shannon calc fix to CHANGELOG

This commit is a documentation update to the project's changelog. It describes two security-related changes that were apparently made in earlier code: a heap buffer overflow in the camera-based entropy (randomness) module that could only b…

Heap buffer overflow in camera entropy / Shannon entropy moduleOut-of-bounds write of 49,152 bytes on discontinued Maix Bit deviceRemoval of deterministic os.urandom() PRNG from firmware
b0a7357eby odudex+7−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 82 · Strong
KX KruxKrux BitcoinHardware wallets

chore: bump MaixPy with Shannon changes and RNG removal

This commit updates a bundled firmware component called MaixPy. The commit message says it fixes a 'Shannon heap overflow,' removes an unused random-number binding, and drops support for one hardware variant (Maix Bit). A heap overflow is …

Commit message explicitly mentions fixing a heap overflowRemoval of an unused cryptographic/randomness binding (os.urandom)Submodule bump only; no source-level patch visible in this commit
5c4ece9aby odudex+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →