CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18285Commits captured
17497AI analyses
106High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17497 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Add missing test case for getdata requests from blocks-only peers

This commit only adds a new test case to Bitcoin Core's test suite. It verifies that a block-relay-only peer cannot request transaction data via getdata messages. There is no change to production code, no bug fix, and no security patch.

278710a8by Roqqit+11−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Remove now-redundant PaymentParameters params

This is a routine internal code cleanup in the Lightning Dev Kit's payment-sending logic. It removes a now-unnecessary duplicate argument from a few private functions because the same information is already stored inside the Route object. …

d5d502a9by Valentine Wallace+11−121 file
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 58 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Require Route::route_params

This commit makes a piece of routing data called route_params mandatory in the Lightning Dev Kit library. Previously it was optional, and the code would silently invent a dummy value if it was missing. Now it must always be provided, and o…

API hardening: removes silent fallback to dummy RouteParametersBackwards-compatibility break for pre-0.0.117 serialized Route objectsNo new bounds checks, cryptographic operations, or network parsing changes
41f0809aby Valentine Wallace+229−25213 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Rustfmt send_payment_with_route

This commit is purely a formatting cleanup: it removes a 'skip rustfmt' marker and re-indents a function so the code is easier to read. No behavior, logic, or security properties of the payment-sending code were changed.

e90ab9d2by Valentine Wallace+33−121 file
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net_processing: fix BIP152 first integer interpretation

This change tightens how Bitcoin Core handles a compact-blocks handshake message. The old code read a small number from the network and treated any non-zero value as 'true'; the new code rejects values other than 0 or 1. This prevents a pe…

Protocol field validation gap closedBIP152 specification non-compliance in deserializerPotential state inconsistency between bool interpretation and explicit 0/1 expectation
2d0dce0aby brunoerg+8−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

argsman: allow duplicate registration between HIDDEN and other categories

This commit fixes a bug where Bitcoin Core's graphical wallet (bitcoin-qt) would crash immediately on startup. The crash was caused by an overly strict internal safety check that treated a normal, intentional code pattern as a duplicate-se…

Fixes a regression causing a denial-of-service-like startup crash in bitcoin-qtChange is a relaxation of an internal assertion, not a memory-safety or cryptographic fixNo input-dependent behavior change; crash was deterministic on affected builds
f963f2b6by Pablo Martin+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BT btcsuitebtcd BitcoinNode implementations

rpcclient: add typed SubmitPackage method

This commit adds a new client-side method called SubmitPackage to btcd's RPC client. It does not change any server-side code, mempool logic, or consensus rules. It simply lets programs ask a Bitcoin Core node (version 24+) to submit a grou…

No server-side handler added; only RPC client wrapperInput validation limits transaction count to 1-25Backend version gating prevents calls to unsupported backends
de3d460eby Elle Mouton+122−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 80 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fix invalid dummy pubkey in send_to_route

This commit fixes a programming bug in rust-lightning's send_to_route function. When a user supplied a payment route with no paths or an empty first path, the code tried to create a fallback 'dummy' public key using 32 bytes of data, but p…

panic due to invalid public-key byte lengthdenial-of-service via malformed route inputunwrap on fallible public-key parsing
54cdd85fby Valentine Wallace+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core,secmon): release version bump to 2.12.2 and 1.0.12

This commit is a routine version bump for a Trezor firmware release. It only changes version numbers in header files and translation metadata, plus updates the signed translation package reference. There are no code changes that affect sec…

d621b2e1by PrisionMike+11−119 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/xtask): add `"ui_debug_overlay"` feature on debug builds

This commit fixes a build configuration issue so that debug builds of Trezor firmware, bootloader, and production-test firmware automatically enable a visual 'ui_debug_overlay' feature. That feature displays a small red square marker in th…

No security-relevant code changedChange is purely a debug UI indicatorNo changelog entry requested by vendor
dcb779afby Roman Zeyde+4−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

util: Check write failures before renaming settings.json

This commit fixes a bug in how Bitcoin Core saves its settings file. Previously, if the disk was full or a write failed, the program could replace the user's valid settings file with an empty or corrupted one. Now it checks that the new fi…

Data integrity / data-loss preventionFilesystem/disk-full failure handlingAtomic file replacement safety check
0654511eby Shrey+11−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add pending changelog entry for PR 4656

This commit only adds a pending changelog entry describing an API change in a previous pull request. It contains no code changes, no bug fixes, and no security-related content.

8270c7cdby Elias Rohrer+2−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →