CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16913Commits captured
16841AI analyses
83High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16841 analyses
Highest risk·RSS
Informational 12 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: harden DisableAuth transport tests

This commit only changes tests and clarifies a public comment. It does not alter the actual authentication behavior of the btcd RPC client. The code already only suppresses the internally generated Basic auth header when DisableAuth is tru…

No functional code change; only tests and commentsComment clarification that DisableAuth only suppresses generated Basic auth, not caller-provided Authorization headersTests now cover WebSocket handshake, cookie bypass, and caller-provided headers
52d2fadeby Olaoluwa Osuntokun+186−1272 files
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

integration: stabilize pre-verack disconnect cycles

This change only modifies an integration test file. It makes a test more reliable by waiting for a version response and retrying connection attempts, rather than changing any production code that handles real Bitcoin peer connections. Ther…

76ba8842by Olaoluwa Osuntokun+58−191 file
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

server+connmgr: make outbound startup deterministic

This commit fixes a scheduling bug in how a Bitcoin node decides how many automatic outbound peers to connect to at startup. Previously, if a user had configured permanent peers, those permanent peers could grab internal connection IDs bef…

Non-deterministic outbound peer count at startupPermanent peers could consume connection request IDs before automatic counter sampledPotential for fewer automatic outbound peers than configured, reducing network diversity
58ee9ef6by Olaoluwa Osuntokun+157−224 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 68 · Adequate
BT btcsuitebtcd BitcoinNode implementations

config: reject non-positive maxpeers

This commit fixes a configuration bug in btcd, a Bitcoin node implementation. Previously, setting maxpeers=0 caused the node to enter a tight loop: it would repeatedly try to connect to outbound peers and immediately reject them. The chang…

Denial-of-service-like resource exhaustion via tight reconnect loop triggered by a configuration valueInput validation added for a previously unbounded configuration parameterNo memory corruption, authentication bypass, or remote code execution signals present
7e9414faby Olaoluwa Osuntokun+42−23 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

integration: synchronize p2p lifecycle stress batches

This commit changes only test code. It tightens up an integration test that simulates many fake Bitcoin peers connecting and disconnecting from a node, and makes a small cleanup in a unit test for closing network pipes. There is no change …

No production code changedTest-only synchronization improvementsNo authentication, cryptography, consensus, or network handling logic modified
5a2c5063by Olaoluwa Osuntokun+217−202 files
No security note in commit
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

v2transport: restore responder handshake progress

This commit fixes a deadlock risk in btcd's new Bitcoin v2 transport handshake. Previously, the responder waited until it had received the initiator's full 64-byte key before doing any work, which could cause both sides to sit waiting for …

BIP324 handshake deadlock avoidanceCPU admission lease split to prevent resource exhaustion / lock holding across network I/OResponder now sends key material before full initiator key is received
09717871by Olaoluwa Osuntokun+231−862 files
No security note in commit
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 73 · Adequate
BT btcsuitebtcd BitcoinNode implementations

server+inbound: correct inbound admission accounting

This commit fixes accounting bugs in how btcd counts and limits incoming peer connections. Previously, loopback/whitelisted peers and permanent outbound peers (such as manually added peers) were not correctly counted against connection bud…

Resource-limit accounting correction for inbound peer admissionPer-source rate limits now apply to loopback and whitelisted peersMaxPeers reservation now includes permanent/addpeer outbound slots
95c11c56by Olaoluwa Osuntokun+334−556 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

channelmanager: upgrade best_block_updated log from trace to info

This commit simply changes one diagnostic log message from the lowest detail level ('trace') to a more visible level ('info'). It does not alter program behavior, fix a bug, or change any security-sensitive logic. It is a routine observabi…

bce5ef2fby Alkamal01+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

psbt: decode base64 packets incrementally

This commit changes how btcd reads base64-encoded PSBT (Partially Signed Bitcoin Transaction) data. Previously, the code read the entire base64 input into memory before decoding, and it wrongly applied the Bitcoin P2P wire message size lim…

Removes an incorrect size bound that caused base64 PSBT parsing to reject valid large packets (denial-of-service / interoperability issue)Switches from full in-memory base64 decode to incremental streaming, reducing peak memory for large base64 PSBTsRetains strict base64 alphabet checks and rejects trailing data after the PSBT packet
e333817dby Olaoluwa Osuntokun+129−602 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(l10n): updated blanking rules + removed unused [no changelog]

This commit updates the rules that determine which on-screen text strings are allowed to be left blank (untranslated) in different Trezor device layouts, and removes one unused English string ('Learn more'). It is a localization housekeepi…

66d0c0f2by Michal Kazda+31−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(l10n): applied new blanking rules [no changelog]

This commit only updates English text strings in a translation file for the Trezor hardware wallet. It splits some shared phrases into device-specific versions and blanks out strings that are not used on certain device models. There is no …

c5b2760bby Michal Kazda+171−311 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(l10n): generated files added [no changelog]

This commit is a routine regeneration of translation files for the Trezor hardware wallet firmware. It updates which text strings are shown in different languages and removes one unused string ('instructions__learn_more'). There is no indi…

ea0f76b9by Michal Kazda+19466−194703 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →