CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17488Commits captured
16942AI analyses
87High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

16942 analyses
Highest risk·RSS
Informational 12 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

connmgr: bound accepted inbound connections

This commit adds a new optional feature to btcd's connection manager that lets operators set a maximum number of simultaneous inbound connections. It is a defensive hardening change, not a fix for an active vulnerability. The default behav…

New optional inbound connection limit (resource-exhaustion hardening)Slot released exactly once via sync.Once to prevent double-release or leakRejected connections closed before OnAccept callback to limit work done on excess peers
ad8d94e6by Boris Nagaev+291−74 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 68 · Adequate
BT btcsuitebtcd BitcoinNode implementations

server: centralize inbound handshake admission

This commit adds a new inbound connection rate-limiting and admission-control system to btcd. It is designed to reduce the risk of denial-of-service attacks where an attacker opens many incomplete handshake connections or forces the server…

New DoS-mitigation admission control for inbound handshakesPer-source-prefix limits on incomplete handshakesRate and concurrency limits on CPU-bound v2 responder handshake cryptography
6c056ec4by Boris Nagaev+1001−1812 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add shared SipHash vectors

This commit only adds new test data and test code for the SipHash hashing function used in Bitcoin Core. It does not change any production code that handles transactions, networking, or wallets. The goal is to make sure the existing SipHas…

af50ba85by Lőrinc+797−237 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Reduce Zcash batch limit to 35

This commit lowers the maximum number of Zcash transactions that can be processed in one batch from 50 to 35. It appears to be a defensive hardening change to reduce memory pressure or processing load on the hardware wallet during batch si…

Resource limit reduction (batch size cap lowered)No mention of CVE, bug, vulnerability, or exploit in commit messageUnit test updated to reflect new limit enforcement
13662ea0by Adam Tucker+3−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

uint256: Workaround GCC-14 stringop-overread bug in Compare

This is a compiler-specific workaround, not a fix for a security vulnerability in Bitcoin Core itself. The change swaps a low-level memory comparison for a C++ standard-library comparison in a 256-bit integer class, solely to silence a fal…

Commit title references a compiler bug, not a product vulnerabilityChange is a functional equivalent rewrite of a comparison routineNo input validation, memory allocation, or cryptographic path is modified
fa5cbb89by Ava Chow+7−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 45 · Thin
LL Lightning LabsLND BitcoinLightning Network

kvdb/sqlbase: relax bulk migration isolation

This commit changes a database migration transaction from the strictest isolation level (Serializable) to a more relaxed one (Read Committed) for PostgreSQL bulk migrations. The stated reason is to prevent PostgreSQL from using excessive m…

Transaction isolation level lowered from Serializable to Read CommittedBulk migration operates on an empty destination database owned by the migrationNo authentication, authorization, or input-validation changes
18bbdb53by ziggie+6−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Move cluster_linearize.h contents into cluster_linearize namespace

This commit is a minor code cleanup in a test-only header file. It moves helper functions from an anonymous namespace into a named namespace and removes some compiler-hint annotations. There is no change to how Bitcoin Core validates trans…

21b4b790by Hennadii Stepanov+4−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 41 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Remove githooks

This commit simply deletes the project's optional Git hooks and the documentation and helper scripts that installed them. Git hooks are local developer convenience scripts that run on your own machine when you commit or merge code. Removin…

e1fd9839by Nick Johnson+0−1315 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

ci: clean up cross with more recent version

This commit updates the project's continuous integration (CI) setup for cross-compilation testing. It removes a custom Docker image and configuration, and instead installs a specific newer version of the 'cross' tool directly from its GitH…

9342d9dfby Nick Johnson+1−593 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Aligning the streaming review to the normal one - using "To" for "Adddress"

This commit changes a single label shown on Ledger hardware wallet screens during Bitcoin transaction review. The label 'Address' is renamed to 'To' in the streaming transaction review flow so it matches the regular (non-streaming) review …

0d4a7599by Ilya Artemov+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

[auto-update] Update Ragger snapshots

This commit only updates test screenshot images (called 'Ragger snapshots') used to check what the Ledger device screen looks like during automated testing. No application code, firmware, or user-facing behavior was changed. It is not a se…

643885b6by github-actions[bot]+0−0103 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

io: update API tests to new conventions

This commit only renames test functions and updates comments in a single Rust test file. It makes no changes to actual library code, behavior, or security-sensitive logic.

480b5da1by Nick Johnson+8−81 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →