CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16871Commits captured
16820AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16820 analyses
Highest risk·RSS
Informational 18 AI analysisMessage 65 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct docs on `ChannelSigner::get_per_commitment_point`

This commit only updates documentation comments for a Rust function called get_per_commitment_point. It removes an outdated warning that the method was non-asynchronous and that returning an error could cause a crash, and replaces it with …

Documentation-only changeRemoves outdated panic warningAdds retry/unblock guidance for signer errors
5057809bby Matt Corallo+6−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 85 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: guard Solana USB pubkey service for non-web3 builds

This commit fixes a firmware build problem, not a runtime security bug. The Solana USB public-key service was calling a function that only exists in the multi-coin 'web3' firmware variant, so the more limited 'cypherpunk' and 'bitcoin-only…

Build/link-time failure fix for conditional feature compilationExplicit error response added for unsupported coin type on non-web3 buildsNo input validation, memory safety, or cryptographic changes observed
9d04150dby John Boyd+10−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core/ethereum): reject invalid initial chunk

This commit fixes a validation bug in Trezor's Ethereum transaction signing. Previously, the device only checked whether the initial data chunk was too large when the transaction also contained non-zero data length. Now it always rejects a…

Input validation bypass fixedDefensive length check broadenedTest coverage added for zero-data-length case
b5e27a2dby Roman Zeyde+28−252 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 85 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat(zcash): tag outputs to the wallet's own address as Mine

This commit fixes a UI labeling bug in the Keystone hardware wallet's Zcash transaction review screen. Previously, when a user sent Zcash to one of their own shielded addresses (an 'external' address, not a change address), the device disp…

UI mislabeling of self-owned Zcash shielded outputsNew `is_mine` ownership flag propagated across Rust/C FFI boundaryNo change to signing logic, key handling, or transaction validation
9eb7f4c3by John Boyd+57−45 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 60 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Fix presets with sighash flags in app playground

This commit fixes a bug in internal developer/test tooling for Ledger's Bitcoin app. The bug caused test PSBTs (Partially Signed Bitcoin Transactions) with certain SIGHASH flags to be built incorrectly, because the tool wrongly assumed the…

Fixes incorrect transaction balancing assumption for non-ALL sighash types in test toolingAdds explicit validation that remainder outputs are disallowed when amounts are not fully committedMoves sighash assignment into PSBT creation to keep metadata consistent
103511c2by Salvatore Ingala+68−162 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

docs(core): add a changelog entry for #7388

This commit only adds a one-line changelog note saying a host-disconnection handling bug was fixed for the T3W1 device. There is no actual code change in the commit, so it cannot by itself introduce or fix a security issue. It merely docum…

d483d11fby Roman Zeyde+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 35 · Opaque
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ln/refactor: remove BlindedTrampolineEntrypoint

This commit is a small internal code cleanup in the Lightning Dev Kit's Trampoline routing code. It removes a separate 'BlindedTrampolineEntrypoint' payload variant and folds an optional blinding point into the existing 'Forward' variant. …

Refactor-only change with no added bounds checks or validationNo mention of vulnerability, CVE, security fix, or bug in commit messageTLV field changed from required to optional, but only for a newly unified variant used in internal construction
3e0c2697by Carla Kirk-Cohen+8−263 files
No security note in commit
Open full analysis →Source commit ↗
Informational 4 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(vendor): update `ts-tvl` to version 2.5

This commit is a routine vendor dependency update, bumping the internal ts-tvl package from version 2.4 to 2.5. The diff only changes one version number in a lock file. There is no visible security fix, vulnerability description, or code c…

f867d6ffby M1nd3r+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

tests(prodtest): remove unsafe YAML parser

This commit removes a custom YAML loader that was used only in production-test helper code. The custom loader accepted special Python object tags so it could read model config files. It is being replaced with the standard safe YAML loader …

Removal of a custom YAML loader that handled python/object/apply tagsSwitch from yaml.load with a custom Loader to yaml.safe_loadCommit message explicitly calls the removed parser 'unsafe YAML parser'
3c35604bby M1nd3r+1−351 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(crypto): replace `int` by `size_t` for nonnegative parameters

This commit is a code-quality cleanup that changes many function parameters from signed integers (`int`) to unsigned size types (`size_t`) where only non-negative lengths or sizes make sense. It also removes some now-unnecessary negative-v…

Defensive type narrowing from signed `int` to unsigned `size_t` for buffer lengths and sizesRemoval of negative-length checks that become logically unnecessary with `size_t`Assertion added in `bn_format` to guard pointer/length arithmetic
78f83c9aby M1nd3r+159−14825 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 81 · Strong
AQ ACINQEclair BitcoinLightning Network

Disable Bolt12 recipient path fee discount (#3332)

This commit removes a fee-discount feature for a new kind of Lightning payment (Bolt12 offers). The old feature let the seller pay routing fees for the hidden 'blinded' path they chose for privacy. But when a payer split a payment into man…

Economic/fee griefing via MPP splitting against Bolt12 blinded-path fee discountRecipient-chosen privacy path fees incorrectly applied per payment part instead of per paymentFeature disablement pending protocol redesign
3397b1a6by Bastien Teinturier+16−123 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

add release notes

This commit only adds a short release note describing a new wallet-migration user-interface option. There is no code change, no bug fix, and no security-related content in the diff.

4cea5957by Pol Espinasa+5−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →