CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16913Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Moderate 57 AI analysisMessage 0 · Opaque
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

follow up

This is a small follow-up patch to a security check inside Sparrow Wallet's database loader. The change tightens how the app scans a wallet file's internal database schema for dangerous commands that could let an attacker run code or link …

Hardening of DDL injection filter in wallet file loaderNew identifier-stripping step to prevent regex evasion via quoted table namesBroadened blacklist pattern for H2-specific dangerous objects (TRIGGER, ALIAS, LINKED TABLE)
8b410ad0by Craig Raw+5−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: fix outdated i2p URLs in comments

This commit only updates outdated web links in documentation and code comments. It does not change any program logic, network behavior, or security checks. There is no security issue here.

419f7427by nebula-21+14−155 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

tests(clear_signing): add external definition fixtures. [no changelog]

This commit is purely a test-data update for Trezor's Ethereum 'clear signing' feature. It removes old built-in test fixtures and adds new externally-supplied token/chain definition files so the test suite can exercise how the device handl…

No production code changesTest-only fixture addition and removalExternal definition loading helpers are test scaffolding
97eaee6cby PrisionMike+984−87826 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(clear_signing): Remove hardcoded LI.FI definitions [no changelog]

This commit removes built-in, hard-coded display rules for the LI.FI swap/bridge protocol from Trezor's Ethereum 'clear signing' feature. It is a feature cleanup, not a fix for a code vulnerability. The change means Trezor will no longer a…

Removal of hard-coded protocol-specific display definitionsNo changes to transaction parsing, signing, or access-control codeTest fixtures migrated to external-definitions test path
ba9fded8by PrisionMike+945−25806 files
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Squashed 'src/secp256k1/' changes from bd0287d650..d2d04864ef

This commit updates the secp256k1 cryptographic library inside Bitcoin Core to a newer version. The main change is adding support for a new optional feature called 'Silent Payments' (BIP352), which is a privacy-enhancing way to receive Bit…

New cryptographic module added (Silent Payments / BIP352)Field-element equality check magnitude bound corrected from 31 to 30X-only public key even-Y invariant enforced in extrakeys module
a33f2405by fanquake+13939−13434 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Use generic arguments for functions

This commit is a routine API cleanup: it makes a few Bitcoin merkle-root functions accept a broader range of input types (generic iterators and borrowed transactions) instead of only slices or exact iterator types. There is no security bug…

e887140aby Mitchell Bagot+26−184 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove .clone() call in check_witness_commitment

This is a minor code cleanup that removes an unnecessary copy of the first transaction in a Bitcoin block validation routine. It does not change behavior, fix a bug, or address any security issue.

3983cd3fby Mitchell Bagot+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 68 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

taproot-primitives: Enable crypto features

This is a small Cargo.toml configuration change that forwards feature flags from the taproot-primitives crate to its internal bitcoin-crypto dependency. It does not change any executable code, fix a bug, or alter behavior under current fea…

No source-code changesNo memory-safety, cryptographic, or input-validation changesNo bug fix or vulnerability remediation described in commit message
8101f23dby Mitchell Bagot+5−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 3 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Use released UR crates 1.0.8

This commit simply switches two software building blocks (called 'crates') from a development Git snapshot to a published release version (1.0.8) on the official Rust package registry. The change itself does not add, remove, or modify any …

fa0add39by Adam Tucker+8−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

contrib: remove old test scripts stale references

This commit is a routine cleanup of leftover references to old test scripts in configuration files. It removes stale entries from a GitHub labeler config, .gitignore, and a label generator, deletes an unused helper script, and inlines its …

069ff853by satsfy (Renato Britto)+2−215 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

primitives: Document check_witness_commitment

This commit only adds documentation comments to an existing Rust function. It explains what the function returns and how that return value can be reused. No code behavior was changed, so there is no security impact.

c150fd94by Tobin C. Harding+7−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(prodtest): add `prodtest-model` command

This commit adds a new diagnostic command to Trezor's production-test firmware that simply reports the device's internal model name. It does not change normal user firmware, does not handle secrets, and does not appear to introduce any sec…

c2796b96by M1nd3r+16−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →