CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16913Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

tests(prodtest): introduce prodtest device tests

This commit only adds automated tests and test-support tooling for Trezor's production-test firmware mode. It does not change the firmware itself, introduce new device commands, or alter how secrets are handled. There is no user-facing sec…

9a271a98by M1nd3r+2329−032 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(prodtest): mention prodtest-tests in docs

This commit only adds documentation. It updates the test documentation to mention how to run production-test firmware tests. There is no code change and no security relevance.

d256f548by M1nd3r+10−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

ci: add prodtest device tests job

This commit only changes the project's automated continuous integration (CI) pipeline. It moves the building and testing of a special 'prodtest emulator' for the T3W1 model from one CI job into its own separate CI job. There are no changes…

6a732963by M1nd3r+30−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(ci): show slowest prodtest tests duration

This commit only adds a CI option to print the 10 slowest test durations during automated testing. It does not change any firmware code, cryptographic operations, or security-sensitive behavior. There is no security issue.

67811b94by M1nd3r+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 68 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Preserve Zcash account firmware version (#37)

This commit is a small, non-security code change. It updates a Zcash wallet test to verify that the firmware version string is preserved when account data is encoded and decoded, and it switches two Rust library dependencies from the publi…

Dependency source changed from crates.io to a third-party Git repository (valargroup/keystone-sdk-rust)No mention of vulnerability, CVE, security fix, or researcher attribution in commit message or diffChange is limited to a unit test assertion and dependency source pinning
20d7ea2dby Adam+11−73 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
SS SeedSignerSeedSigner BitcoinHardware wallets

Merge pull request #956 from newtonick/fix-build-yml-versioning

This is a CI/build pipeline fix, not a security vulnerability fix. The change moves file cleanup from the GitHub Actions workflow into the operating-system build script so that the build script can use files like .git/ and tools/ to write …

No security-relevant code change in the application itselfBuild pipeline hardening: prevents publication of images with missing version metadataNo evidence of vulnerability, exploit, or malicious change
1fb29563by Nick Klockenga+12−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 45 · Thin
SS SeedSignerSeedSigner BitcoinHardware wallets

fix build github action after version addition

This commit fixes the project's automated build process after adding a new version-tracking feature. It moves file cleanup from the GitHub Actions workflow into the build script so the script can read git history and tools, and adds a chec…

Prevents publication of broken firmware images that fail to boot past splash screenAdds build-time integrity check for generated version metadataChanges file deletion timing to preserve build tooling and git metadata needed for reproducible version generation
7cf5cdd8by newtonick+12−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

coins: group private cache helpers

This commit is a pure code cleanup: it moves two internal helper functions (FetchCoin and ReallocateCache) into the existing private section of a C++ class. There are no functional changes, no bug fixes, and no security implications.

c9cedebfby Lőrinc+13−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: Build for macOS using LLVM toolchain only

This commit changes how Bitcoin Core's official macOS builds are produced, switching the build tools from the GNU compiler collection (GCC) to the LLVM/Clang toolchain. It does not change the Bitcoin software itself, only the compiler and …

Toolchain swap in release build pipelineNew linker flags introduced: -fuse-ld=lld -rtlib=compiler-rt -unwindlib=libunwindBuild reproducibility may be affected by compiler/runtime change
8a90c7cdby Hennadii Stepanov+51−205 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

channeldb: recover missing db version

This patch fixes a database migration bug in LND's channel database. Some databases were created without recording their schema version number, which could cause future mandatory upgrades to be skipped. The fix detects that missing version…

Database schema version key can be absent due to an init-ordering regressionMissing version key previously caused migration selection to treat DB as latest, potentially skipping mandatory migrationsFix recovers baseline from last mandatory version before the regression (33)
68264c70by Elle Mouton+176−33 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 54 AI analysisMessage 76 · Adequate
LL Lightning LabsLND BitcoinLightning Network

channeldb: preserve db version during init

This commit fixes a database initialization bug in LND's channel database. Previously, creating an empty metadata bucket during setup could trick the code into thinking an old or partially-created database was already fully up-to-date, pot…

Database version detection logic flawPotential migration skip due to incorrect initialized-state detectionNew explicit error for missing DB version key
619913bfby Elle Mouton+111−104 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

channeldb: make waiting proof migration repeatable

This commit fixes a database migration in LND so it can safely run twice. Previously, if a certain recovery process re-ran migration 35 on a database that already had newer-format 'waiting proof' records, the migration would likely fail or…

Database migration idempotency/robustness fixPotential data corruption or node startup failure if migration re-run against mixed-format bucketNo input validation of attacker-controlled data; issue is local/state-recovery only
3aff61aeby Elle Mouton+93−02 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →