CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16913Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 55 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

fuzz: move rustflag handing into fuzz.sh

This commit is a routine cleanup of the project's internal fuzz-testing scripts. It moves the logic that sets special compiler flags for fuzzing from the GitHub Actions workflow file into the fuzz.sh shell script. There is no change to the…

82c5ac0fby Nick Johnson+14−122 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: detach fuzz cron from bin generation

This commit is a maintenance-only change to the project's automated fuzz testing setup. It switches the daily fuzzing workflow from generating one GitHub Actions job per fuzz target to running targets across a fixed set of 16 shared jobs. …

c93aedc1by Nick Johnson+16−2092 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

fuzz: update the generate-files script to only discover and manage bins

This commit is a routine maintenance change to the project's fuzz-testing build script. It changes how the list of fuzz test programs is generated and written into a configuration file, but it does not alter the actual Bitcoin library code…

f9deb1c0by Nick Johnson+17−1612 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

fuzz: rename generate files script

This commit simply renames a fuzz-testing helper script from `generate-files.sh` to `generate-bins.sh` and updates the comments and README that reference it. The script's behavior is unchanged. There is no effect on the actual Bitcoin libr…

97f9d5a0by Nick Johnson+44−474 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

docs: Fixing Ubuntu installation docs - updated release tag references - removed protobuf-compiler dependency - removed rustup default installation, changed it to only for Ubuntu <25.10 (rust <1.85) - added note about tzdata config halting execution

This commit only updates the project's documentation for installing Core Lightning on Ubuntu. It refreshes supported Ubuntu versions, dependency package lists, release tag examples, and Rust setup instructions. There are no code changes an…

947ed0f3by ScuttoZ+32−211 file
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Update mp::g_thread_context references

This is a small internal code cleanup in Bitcoin Core's inter-process communication (IPC) code. It replaces direct references to a global thread-local variable with a helper function so the code works around a compiler bug in Windows MinGW…

No security-relevant code change identifiedRefactor only: replaces direct global variable access with inline wrapperCommit message describes motivation as compiler compatibility, not security
d3d74e70by Ryan Ofsky+12−53 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: Fix `glibc` version in comment

This commit only changes a comment in a build script, correcting the noted version of a software library from 2.39 to 2.41. No actual code behavior is changed, so it has no security effect.

80f83149by Hennadii Stepanov+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: Use C.UTF-8 locale in Guix scripts

This commit is a routine cleanup that changes the locale setting in Bitcoin Core's Guix build scripts from the old ASCII-only 'C' locale to the modern 'C.UTF-8' locale. It is not a security fix and does not change any behavior that could b…

8916f796by Hennadii Stepanov+15−1515 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(tools): exception for English is no longer necessary in crowdin.py [no changelog]

This commit removes a small workaround in a translation-management script. Previously the script skipped English because English was added as a target language in the Crowdin translation platform, which produced empty English translation f…

6801273fby Michal Kazda+0−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

CI: set readme branch name to stable

This commit only changes the branch name used by an automated documentation-publishing workflow from '1' to 'stable'. It affects how Core Lightning's public guides are synced to a documentation hosting service (ReadMe). There is no change …

6a243ef5by daywalker90+5−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Suppress implicit-unsigned-integer-truncation:SaltedCoinsCacheHasher::operator()

This commit adds a single line to a test-only sanitizer suppression file. It tells the UndefinedBehaviorSanitizer (UBSan) to ignore a specific unsigned integer truncation warning inside a hash function used by Bitcoin Core's coin cache. Th…

Suppression of an undefined-behavior sanitizer warningWarning concerns implicit unsigned integer truncation in a hash functionChange is confined to a test/CI sanitizer suppression file
fa7f5537by MarcoFalke+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 66 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net: Simplify `AddressPosition` comparitor

This is a small code cleanup in Bitcoin Core's address manager. It changes how one internal data structure compares equality so it works correctly when used with const references, and removes an unused header include. There is no security …

075e7f42by rustaceanrob+1−51 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →