CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16913Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
High 72 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/bitcoin): Reject new external outputs in bitcoin replacement transactions.

This update fixes a security gap in how Trezor handles Bitcoin 'replacement transactions' (used to speed up or adjust a pending payment). Before the fix, a non-payjoin replacement could silently add a brand-new external recipient output, p…

Missing authorization / confirmation bypass for new external outputs in replacement transactionsPotential fund redirection via output manipulation in RBF/bumped transactionsAddition of defensive validation with explicit error raise
62891383by Andrew Kozlik+95−153 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): discard low-order keys in Code Entry pairing

This update fixes a cryptographic weakness in Trezor's 'Code Entry' pairing feature, which lets a phone or computer connect to a Trezor device. Before the fix, an attacker could supply a special invalid public key that would cause the pair…

Rejection of low-order Curve25519 public keys in CPace key exchangeRejection of all-zero shared secret resulting from curve25519 multiplicationReplacement of direct equality comparison with constant-time consteq for tag validation
328d692fby M1nd3r+121−44 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): check unique stake withdraw recipient

This update fixes a display issue in Trezor's Solana staking withdrawal flow. Previously, when withdrawing staked SOL, the device could show only the total amount being withdrawn even if multiple different recipients were involved, and in …

UI flow could hide per-recipient amounts in multi-recipient stake withdrawalsMixed transactions could abort special flow after showing a warning, potentially without full user confirmationChangelog filed under .security category
31e05613by Jakub Janků+7−22 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 76 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): show account owner to user

This update fixes a security gap in how Trezor displays Solana transactions. When creating or allocating a Solana account, the device now shows the 'owner' program that will control the new account. Before this change, a malicious owner co…

Missing security-critical UI field for account ownershipSocial-engineering / transaction-tampering vector via malicious owner programFunds-at-risk because CreateAccount instructions deposit lamports immediately
f3d5724fby Jakub Janků+33−33 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): check owner in predefined flow

This update tightens a Solana staking flow in Trezor firmware so that the device now verifies the staking account is owned by the legitimate Stake program before showing the user a friendly confirmation screen. Previously, a crafted transa…

Missing input validation in a predefined transaction confirmation pathUI prompt could be shown for a transaction with an unexpected program ownerDefense-in-depth check added for Solana staking account owner
5d781accby Jakub Janků+11−72 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 97 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): show `source_account` when approving a delegate

This update fixes a display issue in Trezor's Solana token support. When a user approves a delegate (someone who can spend tokens on their behalf) using the older 'Approve' instruction, the device screen previously did not show which token…

UI display omission for sensitive authorization actionRisk of user approving unintended token account delegateFix aligns deprecated instruction UI with checked instruction UI
13abf4deby Jakub Janků+22−23 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): show threshold on multisig init

This commit fixes a misleading display on Trezor hardware wallets when a user initializes a Solana multisig account. Previously, the device only showed the list of possible signers without showing how many signatures were actually required…

UI misrepresentation of authorization thresholdMissing display of critical multisig parameterPotential false sense of security for low-threshold multisigs
f5305c2fby Jakub Janků+28−83 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): simplify EIP-712 domain confirmation flow

This commit simplifies how a Trezor hardware wallet asks the user to confirm details when signing Ethereum typed-data messages (EIP-712). Previously, the device first showed only the domain name and version and asked the user to press 'sho…

Removes user-controlled 'show more' gate for EIP712Domain fieldsEliminates prefetched/cached domain values that could diverge from later hashing pathUnconditionally displays all EIP712Domain fields during signing
b408aa0aby Roman Zeyde+2−563 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 88 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): group EIP-712 domain confirmations

This commit changes how Trezor devices ask the user to confirm details for EIP-712 typed Ethereum signatures. Instead of showing each piece of the 'EIP712Domain' section one by one, it groups them into a single screen on newer devices. It …

New user-visible warning when EIP712Domain is emptyEIP712Domain nested member rejected as unexpected per EIP-712 specDomain fields grouped into single confirmation screen, reducing confirmation fatigue
09e3f9cbby Roman Zeyde+493−3988 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core): update `InputFlowEIP712ShowMore`

This commit only updates an automated test helper for Trezor hardware wallets. It makes the test script more precise about which on-screen prompts it expects during EIP-712 typed-data signing flows. There is no change to the firmware, wall…

ad2545b6by Roman Zeyde+23−162 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): solana transfer showing LUT address

This update fixes a display bug in Trezor's Solana token transfer screens. When a transaction destination was stored in an off-device 'address lookup table' (ALT), the device used to show the lookup table's own address as the recipient, in…

UI spoofing/misattribution: wrong recipient address shown to userAddress Lookup Table (ALT) reference not resolvable on-deviceChangelog explicitly labels the change as a security fix
537b34f8by obrusvit+58−124 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): show maximal coordinator fee rate

This commit adds a new line on the Trezor screen when authorizing a CoinJoin: it now shows the 'Max coordinator fee rate' alongside the existing 'Max rounds' and 'Max mining fee'. This is a user-interface improvement that gives the device …

UI-only change: no authorization or fee-enforcement logic alteredNew user-visible field surfaces coordinator fee rate that was already present in the protocol messageNo new parsing, no buffer-size changes, no cryptographic operations
e369fb17by Roman Zeyde+448−37118 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →