CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17488Commits captured
17116AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17116 analyses
Highest risk·RSS
Informational 24 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core/prodtest): enable writing MCU attestation certificate

This commit changes a factory-production testing tool (prodtest) so that the commands for writing and reading the device's MCU attestation certificate also work in the software emulator, instead of returning 'not implemented'. In the emula…

Removal of compile-time disabling of certificate write/read in emulator buildCertificate chain validation (check_device_cert_chain) is now exercised in emulator pathEmulator write path explicitly warns that certificate is non-persistent
0a7deb3eby Ondřej Vejpustek+6−111 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: add debug root ed25519 key

This commit adds a new public 'debug' root key for verifying device authentication certificates on a Trezor hardware wallet variant (T3W1). It is a public key addition only, not a code change that fixes or introduces a vulnerability. The k…

Addition of a debug root authentication keyTest fixture switched from an unspecified key to the new debug root keyNo code logic changes; only key material/configuration
158979e0by Ondřej Vejpustek+10−14 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: add debug root ML-DSA key

This commit adds a new public 'debug' root key for a quantum-resistant signature scheme called ML-DSA-44. It is labeled DEBUG, which means it is intended only for development/testing and is not a production key. The change only inserts a p…

Addition of a DEBUG-labeled root public key for ML-DSA-44No executable code changes; only key material constants addedKey is added to HSM/prodtest key list and Python library root-key module
17f783cdby Ondřej Vejpustek+116−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): add testing MCU attestation certificate

This commit adds a test-only digital certificate for the T3W1 hardware emulator. It is explicitly labeled as a testing certificate for emulators, lives in a 'unix' emulator directory, and is not used in real Trezor devices. There is no dir…

Test-only certificate material added to emulator pathREADME explicitly states 'Certificate chains for emulators'Root ML-DSA seed is disclosed in README as a known test value
83b0cf37by Ondřej Vejpustek+347−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): add testing tropic attestation key and certificate

This commit updates Trezor's internal test-only files that simulate a TROPIC01 secure chip. It replaces old self-signed test certificates with a new four-level test certificate chain and embeds keys directly into config files instead of re…

Hardcoded cryptographic private key material in test fixtures (l3.key / X25519 seed)Addition of certificate chain generation script for test modelRemoval of older self-signed test certificates
e6e20071by Ondřej Vejpustek+560−21022 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: introduce new debug root P-256 key

This commit swaps in a new developer-debug-only public root key used to verify device certificates during factory testing. The old debug key is kept as a backup for compatibility. It is not a fix for a live user-facing vulnerability and do…

Root public key rotation for debug/test trust anchorOld key retained for backward compatibilityNo production root keys changed
b55a7ca0by Ondřej Vejpustek+19−45 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fix testing Optiga certificates

This commit updates test-only digital certificates used in Trezor firmware emulators for the T3W1 model. It does not change production device code. The certificates are part of the emulator's simulated secure chip environment and are not s…

Certificate regeneration in test-only emulator pathREADME documents use of a customized test HSM with a disclosed root private keyNo production firmware code or real device certificate store is modified
360decd3by Ondřej Vejpustek+80−713 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(tests): check key identifier

This commit only adds extra checks inside test code for verifying certificate chain identifiers. It does not change the actual Trezor firmware or device behavior, so it does not introduce or fix a security vulnerability in the product itse…

Adds test-level certificate chain validation (AKI/SKI matching)No changes to firmware or production code pathsNo changelog entry (explicit [no changelog])
a69b1db4by Ondřej Vejpustek+39−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(tests): test serial numbers in certificates match

This commit adds a new automated test that checks whether the serial numbers embedded in three different security certificates inside a Trezor device all match. It does not change any production firmware code, fix a bug, or alter device be…

Adds a regression test for certificate serial-number consistencyNo changes to firmware, cryptography, or authentication logicNo changelog entry (marked [no changelog])
a789984fby Ondřej Vejpustek+24−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(tests): always check basic constraints extension

This commit only changes a test helper file in the Trezor firmware repository. It tightens how test code validates X.509 certificate chains by always checking the BasicConstraints extension and path length, rather than skipping the check w…

Test-only changeStrengthens certificate chain validation in test helperRemoves silent pass on missing BasicConstraints extension
ce0e3b2fby Ondřej Vejpustek+6−101 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(tests): make `verify_cert_chain()` accept longer certificate chains

This commit changes only a test helper function in the Trezor firmware test suite. It moves a common-name check to the beginning of certificate-chain verification so the function can handle chains longer than before. There is no change to …

c3d46193by Ondřej Vejpustek+6−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(tests): refactor `verify_cert_chain()`

This commit is a code cleanup in the test suite. It merges two nearly identical certificate-verification routines into one shared helper and removes duplicated code. There is no change to the actual security checks performed, no change to …

c94d5dcbby Ondřej Vejpustek+30−531 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →