CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16883Commits captured
16828AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16828 analyses
Highest risk·RSS
Informational 12 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fixed coderabbit issues [no changelog]

This commit makes two tiny UI code cleanups: it removes an unnecessary colon from a transaction summary label and adjusts a Python type-hint return type. There is no indication these changes fix a security issue or affect how funds or secr…

ed82b4a7by Michal Kazda+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fixed failing detection of French display language [no changelog]

This is a tiny UI text-formatting fix. The code that decides whether to put a space before a colon (a French typographic rule) was checking for the wrong language code ('fr' instead of 'fr-FR'). The patch corrects the code so French labels…

6987b216by Michal Kazda+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): update fixtures [no changelog]

This commit only updates the expected visual test snapshots (hashes of screen images) in a test data file. It does not change any firmware, application, or cryptographic code. There is no direct security relevance visible in the commit its…

cbc5e828by Michal Kazda+1866−18661 file
No security note in commit
Open full analysis →Source commit ↗
Informational 6 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

align no usb sp support error message with related exceptions

This commit only changes the wording of an error message shown when a USB security-key feature is not supported. There is no indication it fixes a security flaw or changes program behavior beyond making the message consistent with other si…

969dd72dby Craig Raw+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

optimize sol derivation path allocation

This commit refactors how a Solana cryptocurrency derivation path is stored while parsing a USB request. Previously, the code dynamically allocated a small heap buffer inside a helper function and returned it to the caller, which then had …

Eliminates heap allocation for a fixed-size derivation-path bufferRemoves manual free responsibility from caller, reducing memory leak / use-after-free riskSwitches helper return type from pointer to bool to enforce explicit success/failure handling
9c3efd94by ww3512687+12−201 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add opt-in xdg application directory support

This commit changes where Sparrow Wallet stores its files on macOS and Linux to optionally follow the XDG Base Directory Specification. It is a directory-layout migration, not a fix for a vulnerability. The change could create minor securi…

Directory migration logic with symlink creation and fallback search pathsInstance lock pointer now searched in both new XDG state home and legacy default homeNetwork directory rename logic creates/updates symlinks and may leave stale symlinks
2d667d11by Craig Raw+177−829 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor: remove unused QR code protocols

This commit removes old, custom QR-code transaction formats for Bitcoin-family coins, Ethereum, and XRP, and replaces them with standardized formats. It also adds explicit rejections when the device receives a transaction through the gener…

Removal of custom protobuf-based QR transaction paths reduces attack surfaceExplicit rejection of ur:bytes for Bitcoin-family and Ethereum transactionsLegacy handlers used unwrap() and raw protobuf deserialization on untrusted QR input
28dd305dby soralit+58−5067 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

primitives: Add serde note to crate docs

This commit only adds documentation to the primitives crate explaining how users should handle serde serialization for certain Bitcoin data types. It does not change any code behavior, fix a bug, or alter security-relevant logic.

35d2bbd5by Mitchell Bagot+19−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: upgrade rust version

This commit upgrades the Rust compiler toolchain from one nightly version to a newer one and adjusts code to keep the project building and tests passing. It does not fix a known security bug or change how user funds are protected. Most of …

82a48133by soralit+511−1321 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

github: bump gateway code-review to v0.6.0

This commit updates a GitHub Actions workflow that runs an optional code-review bot called 'gateway'. It only changes two pinned version numbers (SHA hashes) for the bot's action and its runtime, moving from v0.5.0 to v0.6.0. There is no c…

17a4d42fby Suheb+4−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Update API files

This commit only updates a generated API snapshot file (all-features.txt). It records that some serde helper functions now require only Encode for serialization and only Decode for deserialization, rather than requiring both traits. The ac…

76b1f333by Mitchell Bagot+6−61 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →