CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16841Commits captured
7504AI analyses
60High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

7504 analyses
Highest risk·RSS
Moderate 52 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: remove Maix Bit and CIF camera support

This commit removes support for an old, discontinued hardware device called the Maix Bit from the Krux Bitcoin wallet firmware. The commit message says the Maix Bit's camera resolution (CIF) was the only one that fed frames larger than QVG…

Buffer overflow / scratch buffer overflow claimed in commit message (49,152 bytes)Removal of vulnerable hardware code path rather than hardening the entropy moduleDiscontinuation of affected device reduces real-world exposure
8090ac73by odudex+11−1279 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

refactor: use native uUR on tests and simulator

This commit is a routine engineering cleanup: it removes a Python-only compatibility layer (a 'shim') used for testing and simulation, and makes the test environment use the same C-language UR encoder/decoder module that the real hardware …

2fe2f5f5by odudex+108−24919 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

p2p: reject empty getblocktxn requests

This change makes Bitcoin Core disconnect any peer that sends a 'getblocktxn' message asking for zero transactions. Such a request is pointless because if no transactions are missing, the receiver already has everything it needs to reconst…

Denial-of-service hardening: prevents a peer from forcing the node to read a block from disk for no legitimate purposeProtocol invariant enforcement: empty getblocktxn requests are semantically invalid under BIP 152 compact block reconstructionPeer misbehavior response: disconnects rather than servicing the request
28641fd1by furszy+20−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

p2p: reject filtered block inv early when bloom is disabled

This change makes Bitcoin Core disconnect a peer earlier when it asks for a 'filtered block' from a node that does not advertise bloom-filter support. Previously, the node would read the block from disk first and only then ignore the reque…

Adds early validation of peer request against advertised service bitsDisconnects peer on protocol violation instead of silently ignoring after disk I/OAvoids unnecessary disk read for a request that will be rejected anyway
9871fb72by furszy+13−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: split p2p_getdata.py in sub-cases

This commit is a simple code cleanup in a test file. It takes an existing test and moves it into a separate helper method, then calls that method from the main test runner. There is no change to Bitcoin Core's actual network code, no bug f…

aaf94120by furszy+5−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 60 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

udev: Remove group from rules

This commit removes the 'plugdev' group assignment from Linux udev rules that grant user access to Bitcoin hardware wallets. The change is a compatibility fix for newer systemd versions (258+), which no longer allow non-system groups in ud…

udev rules modifiedGROUP attribute removedAccess mode preserved (0660/0666)
46398257by Ava Chow+14−144 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 60 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

udev: Add uaccess tag to coldcard rules

This commit updates the Linux device rules for the Coldcard hardware wallet so that normal users can access the device on newer Linux systems that use systemd 258 or later. Without this change, the wallet might not be detected or usable by…

udev rule change affecting device access permissionssystemd 258 compatibility requirement for uaccess tagretains permissive MODE=0666 and GROUP=plugdev settings
cf66cb77by Ava Chow+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Account for message type prefix len in prevtx length enforcement

This commit fixes a small but real accounting bug in how rust-lightning checks whether a previous transaction (prevtx) attached to a funding input will make the resulting Lightning wire message too large. The code previously compared the m…

Off-by-constant length check in protocol message size enforcementPotential acceptance of a prevtx that produces an oversized Lightning wire messageDenial-of-service / protocol-interop risk from peer message rejection
d29e1415by Wilmer Paulino+21−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

fuzz: fix ci job, install cargo-fuzz first

This commit fixes the project's daily automated fuzzing test job. It adds an explicit installation step for the cargo-fuzz tool, ensures the script uses bash so error handling works correctly, and fixes a shell variable expansion quirk so …

6aec26dcby Nick Johnson+4−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for Edge release.

This commit only updates the release signature file. It adds two new firmware file hashes for recently built releases and refreshes the PGP signature that covers the file. There is no code change and no indication of a security fix or vuln…

9a88e1a5by Peter D. Gray+10−81 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(rust/trezor-thp): channel desync after incorrect ACK

This commit fixes a bug in the Trezor hardware wallet's custom transport protocol (THP). Previously, when the device received an incorrect or out-of-order acknowledgment (ACK), it would not advance its internal send state but would still l…

Protocol state-machine change around ACK handlingExplicit rejection of unexpected ACK bitsDesynchronization / channel sync issue mentioned in commit title
ded1c141by Martin Milata+8−62 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →