CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16866Commits captured
15908AI analyses
80High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

15908 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): update fixtures [no changelog]

This commit only updates a test data file (tests/ui_tests/fixtures.json) containing expected screenshot hashes for automated UI tests. It does not change any firmware, application, or cryptographic code. The hash changes are expected when …

fa03aa9aby Michal Kazda+1100−11001 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: merge check-semver scripts into one

This commit is a cleanup of the project's automated version-compatibility checking scripts. It merges two separate scripts into one and updates the GitHub Actions workflow that runs them. There is no change to the actual Bitcoin library co…

No changes to library source codeCI-only refactorWorkflow adds a comment citing GitHub security best practices for pull_request workflows and labeler follow-up jobs
2be88754by Nick Johnson+241−4124 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 90 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Include to_self_delay size in DelayedPaymentOutput weight calculation

This commit fixes a small accounting bug in how the Lightning wallet estimates the size (and therefore transaction fee) of a special Bitcoin transaction that sweeps funds back to the user after a channel closes. The old code always assumed…

debug assertion failure possible in development/testing buildstransaction weight/fee estimate overestimation up to 3 WUconstant replaced with per-descriptor length computation
e6652237by Matt Morehouse+97−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(translations): sync Crowdin translations

This commit is a routine synchronization of translated user-interface text for the Trezor hardware wallet. It only changes wording in Czech, German, Spanish, French, and Portuguese translation files. There is no code change, no security fi…

69186f17by Thalarion+1039−3495 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): update fixtures [no changelog]

This commit only updates expected test result hashes (called 'fixtures') in a single test data file. It does not change any actual device firmware code, cryptographic logic, or user-facing behavior. The hash changes are consistent with a r…

01190701by Michal Kazda+1556−15561 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): add signatures [no changelog]

This commit simply updates a metadata file that records a digital signature (a 'merkle_root') for translation data in a Trezor hardware wallet. There is no code change, no bug fix, and no security issue visible in the diff. It appears to b…

f83c7a79by Michal Kazda+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 71 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

Remove deprecated `secp256k1_schnorrsig_sign` alias

This commit removes an old, renamed function called secp256k1_schnorrsig_sign from the libsecp256k1 cryptographic library. It had been marked as deprecated for over three years and was simply an alias pointing to the newer secp256k1_schnor…

No security-relevant code change: only a deprecated alias and its test are removedNo memory safety, cryptographic, or input validation changesNo bug fix, vulnerability patch, or incident disclosure present in commit or references
e14756bdby Sebastian Falbesoner+4−194 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): support for calldata formatter. - scaffolding

This commit is purely scaffolding for a new Ethereum clear-signing feature. It adds a new data type (FORMATTER_CALLDATA), two new optional fields (callee_path and selector) to message definitions, and two new user-facing text labels ('Subc…

03741838by PrisionMike+216−3312 files
No security note in commit
Open full analysis →Source commit ↗
Low 39 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): support for calldata formatter. - core changes

This commit adds a new Trezor firmware feature called 'clear signing' for nested Ethereum calls. It lets the device understand when a transaction wraps another contract call (like a router or multicall) and tries to show the user readable …

New nested calldata parsing path with explicit depth cap of 1@.to override to callee to prevent token resolution from pointing at the wrapper contract@.from and @.value rejected in nested parse to avoid displaying confidently wrong sender/value
570eb868by PrisionMike+627−503 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(clear_signing): add device test for calldata formatter.

This commit only adds a new automated test case for an existing Ethereum transaction display feature. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one. It is purely a test-data add…

701624d3by PrisionMike+21−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): Add enum formatter - scaffolding

This commit only adds new data structures and an enum value for a future 'enum formatter' feature in Trezor's Ethereum clear-signing support. It does not change any existing behavior, add parsing logic, or fix a bug. There is no security i…

74269511by PrisionMike+324−336 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): Add enum formatter - core

This commit adds a new display formatter for Ethereum clear signing. It lets a transaction descriptor map numeric enum values (like 1 or 2) to human-readable labels (like 'stable' or 'variable') on the Trezor screen. The change is purely a…

New formatter raises InvalidFormatDefinition on unexpected/missing enum values, causing fallback to blind signing rather than displaying an untrusted labelDuplicate enum keys are rejected at descriptor decode timeNon-integer enum values are rejected at format time
4b25321cby PrisionMike+131−42 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →