We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit only updates a signed release manifest file (signatures.txt). It records new cryptographic hashes for firmware release files and their PGP signature. There is no code change, no bug fix, and no security patch in the commit itse…
47deea23by Peter D. Gray+16−141 fileThis commit only updates an auto-generated timestamp and version string used by the COLDCARD Q1 hardware wallet's FAT filesystem driver. The change is cosmetic/build-metadata only and does not alter any executable logic, security boundary,…
2183c2f0by Peter D. Gray+3−31 fileThis commit simply updates a recorded Bitcoin block height number in a generated file, moving it from block 960,344 to 960,347. There is no code logic change, no user-facing behavior change, and no security relevance.
e1fd9b85by Peter D. Gray+2−21 fileThis commit fixes a critical random-number bug in COLDCARD hardware wallets. The device was accidentally using a weak, software-based fallback random generator instead of its secure hardware one when creating Bitcoin seed phrases. Because …
ca724637by Peter D. Gray+60−711 filesThis commit updates Coldcard's release notes to announce an urgent security fix for a 'limited entropy' bug in how the device generates wallet seeds. On older Mk3 hardware, seeds created after firmware 4.0.1 may have only about 40 bits of …
c3f7529aby Peter D. Gray+148−844 filesThis commit only updates two automatically generated files that store a fixed build date and firmware version number used for timestamps on files written to SD cards. The actual code logic did not change; only the hardcoded date and versio…
9b80afccby Peter D. Gray+6−62 filesThis commit simply updates a stored Bitcoin blockchain height number and its timestamp in a generated data file. It is a routine data refresh with no code changes and no apparent security relevance.
ea19aeefby Peter D. Gray+2−21 fileThis commit is only a wording edit to the COLDCARD firmware changelog, but the changelog text itself discloses a serious security problem: some COLDCARD devices generated wallet seeds with far less randomness than intended. Mk3 devices run…
d9be4503by Peter D. Gray+8−81 fileThis commit only changes version numbers in the changelog and two build makefiles. It does not modify any code, fix any bug, or alter any behavior. The actual security-relevant fix for the 'limited entropy bug' is not present in this diff.
ee36d35aby Peter D. Gray+3−33 filesThis commit simply updates a hardcoded Bitcoin block height number in a firmware file, moving it forward by two blocks. There is no code change that affects security, user funds, or device behavior beyond reflecting a slightly later point …
6691ba63by Peter D. Gray+2−21 fileThis commit only removes a period at the end of one changelog sentence. It is a trivial punctuation/typography fix with no code or security behavior change.
4ba45bc9by Peter D. Gray+1−11 fileThis commit fixes a minor but real security hygiene issue in the BitBox02 Plus hardware wallet. Before the patch, a 32-byte buffer meant to hold freshly generated random bytes for Bluetooth Low Energy (BLE) pairing security was not initial…
135bb8baby benma's agent+1−11 fileA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.