CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16881Commits captured
16827AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16827 analyses
Highest risk·RSS
Low 25 AI analysisMessage 76 · Adequate
AQ ACINQEclair BitcoinLightning Network

Reject `start_batch` with size <= 1 (#3333)

This commit tightens validation of a Lightning network peer message called start_batch. Previously, the software only rejected batch sizes larger than 20. Now it also rejects batch sizes of 0 or 1, which the protocol specification says mus…

Protocol compliance fix for BOLT 2 start_batch validationAdds lower-bound validation that was previously missingPrevents acceptance of degenerate batch sizes (0, 1)
e4e1a19dby Bastien Teinturier+25−32 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 88 · Strong
AQ ACINQEclair BitcoinLightning Network

Don't store duplicate settlement messages (#3336)

This patch fixes a bug in Eclair's Lightning payment channel code. If a buggy peer (or internal message queue bug) sent the same HTLC settlement message twice, Eclair would store the duplicate in its list of pending remote changes. Later, …

Avoids unilateral channel force-close due to duplicate settlement messagesPrevents duplicate remote proposal accumulation in commitment changesMaintains relay of first valid settlement to downstream HTLC origin
3eebbe96by Bastien Teinturier+51−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 77 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

util: LineReader - Don't include newline and acknowledge single-char \r

This is a small code cleanup in Bitcoin Core's line-reading utility. It changes how the reader strips newline characters from input lines. The old code tried to remove both '\n' and '\r' from the end of a line after the fact; the new code …

Input parsing boundary changeLine termination handling changeNo explicit security claim in commit message
e8eaa80cby Hodlinator+4−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): impl maybe_with_colon

This commit is a user-interface polish change for the Trezor hardware wallet. It introduces a helper that adds colons to on-screen labels only for certain visual themes (Bolt and Caesar), and updates Solana transaction confirmation screens…

9eddd93dby obrusvit+32−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): Pylance issues [no changelog]

This commit is a minor code cleanup that changes type annotations in a Solana-related layout file. It removes an unused import and switches three variable type hints from a broader type (PropertyType) to a narrower one (StrPropertyType). T…

56b18b0eby Michal Kazda+4−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): chance fstrings to with_colon in Bolt Caesar [no changelog]

This commit is a code cleanup in the Trezor hardware wallet's user interface. It replaces hard-coded colon punctuation (like 'Amount:') with a helper function called with_colon that adds the colon in a translation-friendly way. There is no…

22c18909by Michal Kazda+22−112 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): remove fstrings from Delizia Eckhart [no changelog]

This commit removes colon characters from the ends of a few on-screen labels in the Trezor hardware wallet's user interface. For example, labels that previously read 'Amount:' now read 'Amount'. There is no security-relevant change visible…

526904f9by Michal Kazda+8−82 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): remove extra maybe_with_colon from Solana [no changelog]

This commit removes an extra colon that was being added to Solana transaction confirmation screens on Trezor devices. The change is cosmetic: it stops showing a duplicate colon in front of property names (like 'Fee payer:' becoming 'Fee pa…

UI label formatting correction in transaction confirmation flowNo cryptographic, parsing, or access-control changesPotential indirect security relevance: unclear labels on hardware-wallet confirmation screens can contribute to user confusion/misapproval
e64eb557by Michal Kazda+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): address Pylance complains [no changelog]

This commit is a minor code cleanup that only changes how Python type-hinting overloads are ordered and how a multi-line import is formatted. It does not change any actual program behavior, user-facing text, security checks, or hardware wa…

bf534199by Michal Kazda+5−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fixing missing colons from parameter="amount" [no changelog]

This commit fixes a UI formatting bug where some labels on the Trezor screen were missing colons. In the Solana app, display names like 'amount' were not getting a trailing colon. The fix applies the colon-adding helper in the Solana-speci…

c8fe90baby Michal Kazda+3−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fixing extra colons [no changelog]

This commit removes duplicate colons from on-screen text labels in the Trezor hardware wallet's Solana app and Bolt UI layout. It is a cosmetic/user-interface cleanup with no security relevance.

c48ca7b8by Michal Kazda+5−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fixed coderabbit issues [no changelog]

This commit makes two tiny UI code cleanups: it removes an unnecessary colon from a transaction summary label and adjusts a Python type-hint return type. There is no indication these changes fix a security issue or affect how funds or secr…

ed82b4a7by Michal Kazda+2−22 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →