CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16911Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 23 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Generate `DNSSECError` messages when DNSSEC resolution fails

This commit adds a new error-reporting path in a Lightning DNS resolver. Previously, if a DNSSEC proof lookup failed, the resolver simply stayed silent. Now it sends back an explicit 'DNSSECError' message so the requester knows the lookup …

Eliminates silent failure on DNSSEC proof resolution errorsAdds authenticated NXDOMAIN signaling to prevent indefinite fallback waitsNo new unsafe code, unwraps, or cryptographic operations introduced
1a4694bfby Matt Corallo+99−71 file
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 95 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct DNSSEC proof validity time gap applied to header time

This commit fixes a typo-like bug in how DNSSEC proofs are checked against the latest known block time. The code was meant to allow a two-hour time window but accidentally used a two-minute window. This could cause valid DNSSEC proofs to b…

Time-window validation bug in DNSSEC proof verificationIntended two-hour tolerance implemented as two-minute toleranceAffects only non-std or fuzzing build configurations
d14c22a3by Matt Corallo+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Rename `OMNameResolver::resolve_name` to `initiate_resolution`

This commit is a simple rename of a Rust method from `resolve_name` to `initiate_resolution`, plus matching updates to comments and test code. It does not change what the code does, only how it is named and described. There is no security …

0460fda6by Matt Corallo+33−202 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BT btcsuitebtcd BitcoinNode implementations

build: bump version to v0.26.2-beta

This commit only changes the software version number from v0.26.1-beta.rc1 to v0.26.2-beta. It does not modify any program logic, network code, or security behavior. There is no security issue here.

d9948c49by Olaoluwa Osuntokun+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Report the used success probabilities in scorer accessor methods

This commit fixes two related issues in rust-lightning's payment scorer. First, two public accessor methods that report estimated payment success probabilities could trigger a debug-only assertion (a crash in debug builds) when asked about…

Debug assertion reachable through public API when amount_msat equals or exceeds channel capacity/max liquidityPublic probability accessors returned raw estimates inconsistent with internal scoring, potentially misleading callersNew lower-bound clamping aligns accessor output with actual routing penalty calculations
68123876by Matt Corallo+39−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Format changed functions

This commit is purely a code-formatting cleanup. It removes `#[rustfmt::skip]` annotations and lets rustfmt reformat several functions in the routing/scoring module. No logic, behavior, or security properties of the code are changed.

05ce4204by Matt Corallo+44−251 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct + update scoring attempts right at the maximum amounts

This commit tweaks how the Lightning payment router estimates whether a payment can fit through a channel. Previously, sending an amount exactly equal to a channel's maximum capacity or estimated liquidity upper bound was treated as imposs…

No security-relevant keywords in commit title or messageNo unsafe code, no input parsing, no serialization format changesNo bounds-checking or integer-overflow fixes
a6964ab9by Matt Corallo+19−131 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

primitives: update API files

This commit only updates generated API snapshot text files to reflect recent changes in public function signatures. It does not change any source code, fix bugs, or alter program behavior. There is no security relevance.

2706ed4eby Nick Johnson+10−103 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Document signing behavior with sighash flags, and external inputs

This commit only adds documentation. It explains how the Ledger Bitcoin app handles unusual signing options (non-default sighash flags and transactions with external inputs) and what warnings users see. There are no code changes, so it doe…

documentation-only changeno executable code modifieddescribes existing security controls (sighash opt-in, external-input warnings)
c4658f0bby Salvatore Ingala+94−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Bump version to 2.5.0

This commit only changes the application's version number in the build file from 2.4.6 to 2.5.0. There are no code changes, no security fixes, and no functional changes visible in this commit.

f8476403by Salvatore Ingala+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Prepare changelog for release 2.5.0

This commit only updates the project's changelog file to prepare for release 2.5.0. It renames an upcoming version placeholder, reorganizes release notes, and adds descriptions of user-facing changes. No source code, build scripts, or secu…

6de87c51by Salvatore Ingala+5−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 50 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Nits from PR review, and update behavior with untrusted external amounts

This commit only changes two documentation files. It clarifies when the Ledger Bitcoin app can and cannot display the total amount of external transaction inputs. The change adds a note that for non-Taproot transactions, if the PSBT lacks …

Documentation-only changeDescribes trust assumptions for external input amounts in PSBTsMentions non-witness-utxo requirement for reliable external-input amount display
cdca63d6by Salvatore Ingala+8−42 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →