CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18178Commits captured
17450AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17450 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(ci): update core-hw actions [no changelog]

This commit is a routine maintenance update to the project's automated testing configuration. It upgrades the versions of some GitHub Actions used in hardware test workflows and simplifies the checkout logic. There is no indication this ch…

5b18b3aeby Michal Kazda+3−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

configure: remove `-c` to link test for macOS

This is a one-line build configuration fix for macOS. The script that checks whether the compiler supports a certain optimization flag was mistakenly passing a 'compile-only' flag during a link test. On macOS, this caused the test to behav…

01074ef5by Daeho Ro+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Fix typo in p2p decoding error docs

This commit only fixes spelling mistakes in code comments and documentation (changing 'occuring' to 'occurring' and adding a missing 'when'). No program logic, behavior, or security properties are changed.

f91a7995by haoshengzhen+20−208 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 88 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(vendor): optimize MicroPython imports

This commit is a small internal cleanup in the Trezor firmware's embedded MicroPython environment. It replaces a helper function call with a direct way to check whether a loaded module is a package, matching a recent upstream MicroPython c…

abcd4dc2by Roman Zeyde+4−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Format possiblyrandom cfg attributes

This commit is purely a code-formatting cleanup. It runs rustfmt on a small Rust source file so that multi-line conditional compilation (cfg) attributes are collapsed onto single lines. No logic, behavior, or security properties of the cod…

bc01a548by Joost Jager+2−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 93 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(common): correct wire direction for Monero *Request messages

This commit fixes a labeling mistake in the Trezor firmware's protocol definition: eleven Monero request messages were incorrectly marked as traveling from the device to the host, when in reality the host sends them to the device. The chan…

Metadata-only correction of message direction tagsNo functional firmware change asserted by commit messageHost-side generated descriptors regenerated to match corrected proto
38db13a4by Martin Varmuza+33−333 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add extendedkey.py unit tests by using BIP32 test vectors

This commit only adds new unit tests for Bitcoin Core's internal test framework. It checks that a helper class for BIP32 extended keys produces the well-known public test-vector outputs. No production wallet, consensus, or networking code …

d2a03d50by rkrux+36−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: introduce ExtendedPrivateKey and ExtendedPublicKey classes

This commit adds a new test-only helper file that implements BIP32-style extended private and public keys for Bitcoin Core's functional test framework. It is purely test infrastructure code and does not change any production wallet, consen…

afdb3780by rkrux+160−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/xtask): pass block_on_vcp and app_loading features to the kernel

This commit fixes a build-system bug in Trezor's embedded firmware build tool. Two command-line options, `block_on_vcp` and `app_loading`, were previously only being forwarded to the firmware build, but not to the kernel build. The change …

Feature flag propagation bug in build toolingKernel may have been built without intended `block_on_vcp` or `app_loading` configurationNo direct runtime code change; risk depends on semantics of the omitted features
0b1ef33dby cepetr+10−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fix logging with BLOCK_ON_VCP enabled

This commit fixes a debug-only logging path used when a special compile-time flag (BLOCK_ON_VCP) is enabled. The old code called a blocking write helper that is not safe from interrupt context, which could have caused the device to freeze …

Blocking operation in interrupt context replaced with non-blocking retry loopNew documentation warnings that blocking syshandle helpers are unsafe from interrupt contextDebug-only code path (BLOCK_ON_VCP) affected, not default firmware behavior
09b59526by cepetr+28−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(common): remove deprecated fields from passphrase-related messages

This commit is a routine cleanup: it removes two old, already-deprecated fields from the messages that Trezor devices and apps use to exchange passphrase information. The fields were marked deprecated in firmware version 2.3.0 and are no l…

a96a9f91by Roman Zeyde+39−1453 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(common): remove deprecated passphrase-related protobuf messages

This commit is a routine cleanup: it removes two old, already-deprecated message types related to passphrase handling from Trezor's protocol definitions and generated code. There is no security fix or vulnerability being patched here; the …

7c514195by Roman Zeyde+357−6807 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →