CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17490Commits captured
17117AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17117 analyses
Highest risk·RSS
Moderate 65 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Small cleanup

This commit removes code that restricted cross-frame messaging to a specific trusted website origin. It now allows messages from any origin ('*') when sending, and only accepts messages from frames with an 'opaque' (null) origin when recei…

postMessage target origin changed from conditional origin to '*'Inbound origin check narrowed to 'null' (opaque origin)Removal of origin-derived trust decision
1dafff87by Nicolas Dorier+2−91 file
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 70 · Adequate
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

feat: embed plugin directory in plugin management (#7381)

This commit refactors BTCPay Server's plugin management into a dedicated plugin and adds an embedded plugin directory that loads content from an external plugin catalog via an iframe. The change moves plugin URLs from the server settings a…

New SafeExternalUrl helper filters plugin metadata URLs to http/https absolute URIs only, mitigating javascript: and relative-link injection in author/documentation fieldsDownloadRemotePlugin now validates that the downloaded manifest identifier matches the requested plugin identifierPlugin directory is rendered via iframe to an external, configurable plugin source, increasing attack surface if the source is compromised or MITM'd
5da26940by thgO.O+3018−169229 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Small code style suggestion

This commit only changes a code style setting in the project's .editorconfig file. It tells developers to prefer shorter expression-bodied method syntax when it fits on one line. There is no functional code change, no bug fix, and no secur…

dfdbea93by Nicolas Dorier+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

update the mutiple language font

This commit is a routine update of the on-device font files for multiple languages (Chinese, German, Spanish, Japanese, Korean, Russian). It adds a few new characters, tweaks some glyph bitmaps, and adjusts the generated font metadata to m…

003beb9cby aaron+1955−152124 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Automated update to rustc stable-1.97.1

This is a routine automated update that changes the pinned stable Rust compiler version in the project's configuration file from 1.96.0 to 1.97.1. It does not modify any source code, dependencies, or security-sensitive settings. There is n…

41258026by Update Stable Rustc Bot+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
SS SeedSignerSeedSigner BitcoinHardware wallets

Merge branch 'dev' into update-linux-docs

This commit is a large merge from the 'dev' branch into a documentation update branch. It primarily adds documentation, build/CI configuration, enclosure files, images, and project scaffolding. There is no code change that introduces a sec…

f42ffff6by Nick Klockenga+135220−0332 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Remove taproot build check

This commit removes a separate CI build step that tested the project with a special 'taproot' compiler flag. It is a workflow cleanup change, not a code change. There is no indication of a security vulnerability.

81a7b82dby elnosh+0−81 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Replace CWalletTx::SetTx with Update

This Bitcoin Core wallet commit changes how the wallet stores transactions that share the same transaction ID (txid) but have different witness data (wtxid). Previously, the wallet would overwrite the stored transaction when a version with…

Defensive refactor of wallet transaction canonicalization logicPrevents wallet from pinning to a downgraded/unconfirmed witness variant after a reorg or conflictAdds invariant assertions (Assert/Assume) on transaction hash equality
0b1af01bby Ava Chow+78−213 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 60 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Show alternate wtxids in gettransaction

This commit adds a new field called 'alternate_wtxids' to the output of the wallet RPC command 'gettransaction' (and related transaction listings). It simply shows other witness transaction IDs that share the same base transaction ID. This…

2d55c7a7by Ava Chow+18−73 files
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 67 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Test for wallet txs with alternate wtxids

This commit adds a new automated test for Bitcoin Core's wallet. It checks that when the same transaction can be spent in two different ways (a lighter 'key path' and a heavier 'script path' on a Taproot output), the wallet correctly repor…

ef2afc6aby Ava Chow+115−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: compat, ensure downgrade preserves tx witness variants

This commit adds a new regression test to Bitcoin Core. It checks that when a wallet created on a newer version is loaded on an older version and then brought back to the newer version, the wallet still remembers alternative 'witness varia…

99bdcb06by furszy+74−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →