CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16913Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(python): configure tox not to skip missing interpreters

This commit changes a single test configuration file (python/tox.ini) to make the tox test runner fail instead of silently skipping Python versions that are not installed. It is a testing/CI reliability tweak with no effect on the Trezor f…

90e07df7by Martin Milata+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: move github label script under the github directory

This commit simply moves a helper shell script from one folder (contrib/) to another (.github/) and updates the path used by a GitHub Actions workflow. It does not change any project code, cryptographic logic, or how the software behaves f…

de0a0970by Nick Johnson+38−382 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: add a CI labeller workflow to handle labeling PRs from all branches

This commit adds a new GitHub Actions workflow that automatically adds or removes an 'API diff' label on pull requests after CI finishes. It is a defensive security improvement: it separates the labeling step from the main CI workflow and …

New GitHub Actions workflow using workflow_run triggerMinimal and scoped permissions (actions:read, contents:read, pull-requests:write)References GitHub Security Lab guidance on preventing pwn requests
0290e6b0by Nick Johnson+42−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

build: set CMAKE_VISIBILITY_INLINES_HIDDEN in REDUCE_EXPORTS

This is a build-system hardening change for Bitcoin Core. It tells the compiler to hide inline C++ functions from the list of symbols exported by shared libraries and executables. This reduces the attack surface by making fewer internal fu…

Defense-in-depth symbol visibility reductionBuild hardening, not a runtime vulnerability fixNo functional code change
3f313a77by fanquake+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: Discourage adding AI agents as commit authors

This commit only adds a single sentence to a project policy document (doc/AI_POLICY.md), telling contributors not to list AI agents as authors or co-authors of commits. It makes no code changes and has no direct security effect on the Bitc…

f5d7cc66by sedited+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Update snapshots

This commit only updates test snapshot images (screenshots used in automated UI testing) for the Ledger Bitcoin app. No application source code, firmware logic, or security-sensitive files were changed. It does not fix or introduce any sec…

c50a49ebby Salvatore Ingala+0−0203 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 85 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

For external input amounts, only show if trustworthy

This commit fixes a security issue in Ledger's Bitcoin app where the device could display a fake external input amount or fee to the user. When signing transactions with external inputs (coins controlled by someone else), the app previousl…

Fixes incorrect trust assumption in UI display for external input amountsPrevents malicious host from forging displayed fee/total via unverified witness-utxoAdds state flag tracking unverified external amounts
5174611dby Salvatore Ingala+103−105 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(ci): allow `python_test` to download older python versions

This commit is a routine CI (continuous integration) maintenance change. It lets the project's automated Python test runner download older Python versions when needed, specifically so tests can run against Python 3.14. It does not change a…

64328647by M1nd3r+17−123 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Make all `const static` class members `constexpr`

This commit is a code cleanup that changes many internal class constants from 'static const' to 'static constexpr'. In modern C++, constexpr constants are automatically inlined and avoid certain linker errors when used in specific ways. Th…

05c35c40by rustaceanrob+38−4024 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net: increase inbound capacity for block-relay-only connections

This Bitcoin Core commit increases the default maximum peer connections from 125 to 200 and reserves half of inbound slots for block-relay-only peers that don't forward ordinary transactions. It also adds eviction logic so that when a new …

Default network capacity increased and inbound peer composition restricted, which can reduce the relative share of attacker-controlled transaction-relay inboundsNew eviction logic specifically targets transaction-relaying inbound peers, making it harder for an attacker to monopolize inbound slots with full-relay connectionsBlock-relay-only inbound capacity is expanded, improving network partition resistance
1b76e047by Martin Zumsande+73−97 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add functional test for inbound maxconnection limits

This commit only adds a new automated test file and registers it in the test runner. It does not change any production code in Bitcoin Core, so it cannot introduce a security vulnerability or fix one directly. The test verifies existing be…

cc59aee1by Amiti Uttarwar+64−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

init: make inbound tx relay percentage configurable

This commit adds a new user-configurable setting called -inboundrelaypercent to Bitcoin Core. It lets node operators choose what percentage of incoming peer connections are allowed to relay transactions, instead of being hard-coded to 50%.…

New configuration option affecting P2P connection slot allocationInput clamped to 0-100 via std::clamp, preventing out-of-range valuesNo validation, cryptography, or consensus code modified
0bd3d3dfby Amiti Uttarwar+19−64 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →