CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18178Commits captured
17450AI analyses
103High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17450 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 93 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): enforce layout scoping for more Rust layouts

This commit is a code cleanup that changes how user-interface layouts are managed in the Trezor firmware. It wraps layout objects in explicit context managers (using `with ... as layout:`) and converts several synchronous-looking helper fu…

Refactoring of UI layout lifecycle managementIntroduction/consistent use of context managers for layout scopingType annotation change from LayoutObj to LayoutContext
00075898by Roman Zeyde+864−7939 files
No security note in commit
Open full analysis →Source commit ↗
High 74 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Reject RGS snapshots that leave our graph absurdly-sized

This commit fixes a denial-of-service weakness in Lightning Dev Kit's rapid gossip sync feature. A malicious or compromised RGS server could send an enormous snapshot of Lightning network data, causing a user's node to allocate so much mem…

OOM/DoS mitigation for semi-trusted gossip data sourceInput-size bounds added to RGS snapshot parsingExplicit security framing in commit message and doc comments
7a89362cby Matt Corallo+45−63 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid over-allocating when reading corrupted lengths for `HashMap`s

This commit fixes a denial-of-service risk when rust-lightning reads saved data containing HashMaps. A corrupted or malicious length field could previously trick the program into reserving a huge amount of memory before it had read any act…

memory allocation controlled by external length fielddeserialization of semi-trusted scorer datadenial-of-service via corrupted length
5b4626faby Matt Corallo+3−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

depends: latest config.guess & config.sub

This commit updates two helper scripts used during Bitcoin Core's build process to the latest versions from the GNU project. These scripts only detect what kind of computer and operating system is being used so the build can choose the rig…

8f035499by fanquake+17−112 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tests): suppress sdl errors in python unit tests

This commit changes only a test script. It adds an environment variable that tells SDL (a multimedia library used during testing) to only log critical input-related messages, reducing noisy test output. There is no change to the actual Tre…

d58cb523by M1nd3r+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

grpc2py: fix F401 and E261 flake8 violations in generator and generated output

This commit is a code cleanup change. It removes an unused 'import json' statement and adds a second space before inline comments in a Python code generator and its generated output. These changes only affect style (flake8 linting rules F4…

397be048by Níckolas Goline+69−752 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(trezor-client): send empty passphrase for standard wallets

This commit fixes a bug in the Trezor client library where users with a standard wallet (no passphrase) were still being prompted to enter a passphrase on their Trezor device. The fix ensures that for standard wallets, the client replies w…

Incorrect handling of passphrase request flow in hardware wallet clientPotential UI confusion or user coercion via unexpected on-device passphrase promptFix aligns host-side behavior with standard wallet semantics
36ad4e89by Dario+4−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: clarify release checklist.

This commit is a one-line documentation edit to the project's release checklist. It adds the instruction to merge the release-candidate pull request before tagging a release. There is no code change, no security fix, and no vulnerability.

4f1a2baeby Rusty Russell+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: remove self from security contacts.

This commit simply removes one email address (Rusty Russell's personal address) from the project's public security contact list, leaving only the Blockstream security address. It is a documentation-only administrative change with no code c…

1e4fdd24by Rusty Russell+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix the build issues

This commit fixes a simple C compiler error in the account manager. A variable named validCount and a loop counter i were used but never declared, and an indentation/whitespace mistake was corrected. There is no security-relevant change vi…

41a41374by aaron+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: add 0.21.1 release notes

This commit only adds a new release notes document for version 0.21.1. It contains no code changes. The document itself describes a prior bug fix about Tor onion service key types, but the commit under review is purely documentation.

9b21d0a4by ziggie+74−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 6 AI analysisMessage 57 · Thin
LL Lightning LabsLND BitcoinLightning Network

build: update tor module to v1.1.7

This commit only bumps the version of an internal Tor-related Go module from v1.1.6 to v1.1.7 in the project's dependency files. No actual code changes are included, and the commit message does not say what changed in the new module versio…

54b3308aby ziggie+3−32 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →