CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
18285Commits captured
17497AI analyses
106High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17497 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Update BOLT quotes channeld/channeld.c: Some BOLT quotes had changed slightly.

This commit only updates a quoted comment from the Lightning protocol specification (BOLT #2) inside the source code. The actual code logic is unchanged. It is a documentation/comment cleanup with no security relevance.

f1633e0bby Níckolas Goline+1−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

test: fix block generation in `test_close_72_block_delay` to reflect correct depth

This is a one-line correction in a test file. The test was generating one too many blocks for the scenario it intended to exercise, so the developer reduced the count from 71 to 70. It does not change any production code, network protocol,…

aa6ecad9by Níckolas Goline+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

DEV.md: cheat sheet for developers and LLMs.

This commit adds a new developer cheat-sheet file (DEV.md) with tips for building, testing, and contributing to Core Lightning. It contains only documentation and no code changes. There is no security issue.

fb8b81d0by Rusty Russell+15−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: generalise byte_to_base58 utility function to allow more version types

This is a small test-only code cleanup. It changes a helper function used only in Bitcoin Core's functional test framework so it can accept a version number either as a single integer or as a sequence of bytes. There is no change to the li…

4dbaa7ccby rkrux+4−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Document that Route::route_params will be required soon

This commit only updates a documentation comment in the source code. It warns developers that a field called route_params on the Route struct will become mandatory in a future release. There are no code changes, no bug fixes, and no securi…

b18ad8b3by Valentine Wallace+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

follow-up prev: trivial clean-up

This commit is a minor code cleanup following a previous change. It renames a parameter, adds type hints, switches some function calls to use keyword arguments, and adds a couple of safety assertions. There is no indication it fixes a secu…

cfb87fdbby SomberNight+37−123 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Revert "Prevent stale fs-store writes after lock cleanup"

This commit undoes a previous safety change in the file-based storage component of the Lightning Dev Kit. The original change tried to prevent an old, slow write from overwriting a newer write after internal cleanup of unused locks. The re…

Reverts a synchronization change intended to prevent stale writes from overwriting newer dataRemoves regression test for stale-write-after-lock-cleanup scenarioReintroduces a window between version allocation and lock-reference acquisition
ce130957by Matt Corallo+1−871 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 50 AI analysisMessage 48 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid leaking stale filesystem store temp files

This change fixes a cleanup problem in the Lightning Dev Kit's file-saving code. When two saves for the same file happen at nearly the same time, an earlier, out-of-date save could leave behind a temporary file containing plain data. The p…

Temporary file leak of historical plaintext dataBest-effort cleanup added on write failure and stale write pathsAsync write ordering can produce stale temp files
1a875a7aby Elias Rohrer+91−412 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

swaps: SWAP_TX_SIZE: add longer explanation (comment)

This commit only adds a detailed code comment explaining how a constant named SWAP_TX_SIZE is used to estimate Bitcoin mining fees for submarine swaps. No program logic, numbers, or behavior were changed. It is purely documentation.

26fdf458by SomberNight+11−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: descriptor: bare multisig at TOP level with 3 pubkeys is allowed

This is a tiny test-only change. It adds one new test case verifying that a specific Bitcoin descriptor pattern—bare multisig with exactly 3 public keys at the top level—is accepted by the descriptor parser. No production code was changed,…

55a4c946by brunoerg+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Extract test assets into TOML files

This commit is a test-only refactoring change. It moves existing test data from a private unit-test file into shared TOML files in a new test_vectors/ directory so the same test cases can be reused by Python, C, and future Rust test suites…

04cdef8bby Salvatore Ingala+1299−2298 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Unit tests for get_extended_pubkey

This commit only adds and reorganizes unit tests for the get_extended_pubkey feature. It does not change the actual app code that runs on the Ledger device, so it cannot introduce a security vulnerability or fix one in shipped software.

88fa41c7by Salvatore Ingala+452−454 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →