CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16913Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: Cache the max_index for bip32 and bip86 address indices

This commit is a straightforward performance optimization. It caches two address-index values in memory instead of reading them from the database twice for every transaction output in every scanned block. The change fixes a slowdown during…

565da833by Christian Decker+15−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 50 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: Read the max_index for addresses from the in-memory cache

This small change makes the wallet's address-listing command read a cached value from memory instead of querying the database each time. It appears to be a performance or consistency cleanup rather than a security fix. There is no direct e…

No security framing in commit title or messageNo input validation, memory, or authorization changesChange is a data-source substitution (DB query -> cached field)
5b9ff9ffby Christian Decker+4−71 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: Update the max_index cache when issuing new addresses

This commit fixes a bug where Core Lightning's in-memory record of the highest address index could fall out of step with the database. When a user generated a new on-chain address, the code updated the database directly but left the cached…

Cache/database inconsistency in address index trackingPotential for stale lower index to overwrite newer persisted indexFreshly generated addresses invisible to wallet rescan/listing until restart
d05815f5by Christian Decker+37−292 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Tests for showing transactions with external inputs

This commit only adds and updates automated test code for the Ledger Bitcoin app. It introduces new test cases that verify how the device screen displays transactions containing external inputs and unusual signature rules. There are no cha…

aa796593by Salvatore Ingala+63−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Update snapshots

This commit only updates test screenshot images (snapshots) used to verify what the Ledger app displays during Bitcoin transaction signing. No application source code was changed, so this cannot directly fix or introduce a security vulnera…

Only test asset (PNG snapshot) changesNo source-code or build-system modificationsNo cryptographic, parsing, or display logic in diff
48fc67dfby Salvatore Ingala+0−0167 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): rename `MsgInSignTx` to `HandlerChainIdArg`

This is a clean internal code rename in the Trezor firmware's Ethereum module. A shared type variable used by two different pieces of code is split into two separate type variables so that a future feature (EthereumSignAuth7702) can use th…

fc8cc311by Roman Zeyde+17−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: Use long form of shell options in Guix scripts

This commit is a purely cosmetic change in Bitcoin Core's Guix build scripts. It replaces the short shell command 'set -e' with its long-form equivalent 'set -o errexit'. Both forms do exactly the same thing: they make the script exit imme…

2cb3bfa8by Hennadii Stepanov+6−66 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fix storage migration

This commit fixes a firmware bug that could crash Trezor T3B1 and T3T1 devices during PIN verification when upgrading from firmware older than 2.9.0. The fix changes a build-time compiler flag condition so that a security feature ('-mcmse'…

Crash during PIN verification after firmware upgradeStorage migration failure on affected devicesCompiler security flag condition expanded to cover additional build configurations
d589df69by cepetr+2−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: Add copyright headers to Guix scripts

This commit only adds or updates copyright and license header comments at the top of several helper scripts used for Bitcoin Core's Guix build process. It does not change any executable code, logic, or behavior. There is no security risk.

711eb10fby Hennadii Stepanov+20−27 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add support for singlesig era hardware wallet

This commit adds support for a new hardware wallet called ERA Wallet to the Sparrow desktop Bitcoin wallet. It is a straightforward feature addition: a new import class that reuses existing code for another similar wallet (Keystone), plus …

febece9eby Craig Raw+78−38 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

update scanned keystores to importer type and model on wallet import

This commit fixes a wallet-import labeling bug. When a user imported a wallet file that had been exported from a hardware-wallet-style source, Sparrow was not correctly updating the keystore's type and model to match the importer. The patc…

UI/data-labeling correctness fixNo cryptographic, network, or privilege changesNo input validation or parsing changes
432758d2by Craig Raw+22−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

chainparams: remove my testnet3 seed

This commit removes one DNS seed server (seed.testnet.bitcoin.sprovoost.nl) from the list used by Bitcoin Core's testnet3 network. DNS seeds help new nodes find peers when they first join the network. The change is a routine operational up…

7295b8beby Sjors Provoost+0−22 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →