CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17490Commits captured
17117AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17117 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/bolt): do not use untranslated strings

This commit is a cosmetic user-interface fix. It replaces the English text labels 'CANCEL' and 'CONFIRM' on the brightness adjustment screen with universal icon buttons (a cancel 'X' and a confirm checkmark). This makes the device look con…

e6a8533aby obrusvit+32−342 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 45 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Increase no-channel peer limit

This commit raises the limit on how many peers without an active payment channel the software will accept connections from, from 250 to 2500. By itself this is a simple configuration tuning change, not a code fix for a specific bug. It cou…

Resource-limit constant increased by 10xNo validation or rate-limiting changes includedNo vendor security disclosure or CVE referenced
56b0c2e7by SaidAlaoui+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

update wix installer template to remove custom directory chooser

This commit removes the Windows installer's custom directory chooser. The installer will now always install Sparrow into a standard per-user location instead of letting the user pick a different folder. This is a routine packaging change t…

No security-relevant code changeInstaller UX change onlyNo privilege model change
9a870ba5by Craig Raw+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Fix LVGL transition style clearing

This commit fixes a bug in how the BitBox02 hardware wallet's user-interface library clears style transitions. Previously, passing 'None' for a transition style would store a null pointer in LVGL's style state, which could later be derefer…

Null-pointer dereference risk in LVGL transition style handling eliminated by removing the local property instead of storing NULLOptional pointer style setters now remove the property on None rather than passing NULL to LVGLTransition descriptor access restricted to crate-private, forcing callers through the LvStyleTransition wrapper
5b6092f4by Niklas Dusenlund+298−1016 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

update wix installer template with capabilities entries

This commit updates the Windows installer for Sparrow Wallet so that the app properly advertises itself to Windows as a handler for 'bitcoin:', 'lightning:', and 'auth47:' web-style links. It also fixes the icon path for those link handler…

URI scheme registration for auth47, bitcoin, lightningWindows registry modifications in installerDefaultIcon path now qualified with INSTALLDIR
b0591d7aby Craig Raw+18−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

update wix installer template to match stock jdk25 plus registry entries

This commit updates the Windows installer template used by Sparrow Wallet to match the version that ships with JDK 25. It also keeps Sparrow's custom registry entries that register 'auth47', 'bitcoin', and 'lightning' web link types with W…

e3db4367by Craig Raw+83−771 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(common): add EIP-7702 authorization signing protobuf definitions

This commit only adds new protocol buffer message definitions for an upcoming Ethereum feature (EIP-7702 authorization signing). It does not contain any actual signing logic, device firmware behavior, or user-interface code. It is a schema…

ad31c3aaby Nicolas Bacca+976−31210 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): don't implement `Lerp` & `InvLerp` for 32-bit integers

This is a routine code cleanup. The developer removed support for 32-bit integer types from two internal helper functions (Lerp and InvLerp) used for calculating intermediate values in the user interface. The reason given is that the under…

163acb28by Roman Zeyde+9−111 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

style(core/rust): fix clippy::cast_lossless where possible

This is a code-style cleanup commit in the Trezor firmware's Rust code. It replaces plain `as` type casts with explicit conversion methods like `u32::from(...)`, `i16::from(...)`, and `f32::from(...)` to satisfy the Rust Clippy lint `cast_…

ab5c27eaby Martin Milata+191−18380 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): use `#![deny(clippy::cast_lossless)]`

This commit only changes build-time lint settings for the Rust compiler. It adds a stricter style check (clippy::cast_lossless) across the project and explicitly allows that same check in auto-generated code where it would be noisy and unh…

825bd82eby Roman Zeyde+2−02 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 50 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

use DestroyAccount if the AccountDataCheck found issues

This commit changes how a hardware crypto wallet (Keystone 3) cleans up a damaged or half-finished user account. Previously, the boot-time cleanup routine erased the account's stored pages but did not always run the same full deletion path…

Incomplete account deletion could leave secure-element key material or wallet metadata after power loss / interrupted operationAccountsDataCheck boot recovery previously duplicated only part of DestroyAccount's cleanupPatch consolidates cleanup through DestroyAccount to reduce inconsistent deletion states
d7d53646by aaron+14−371 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 93 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/rust): don't panic if Rust layout is unavailable

This commit changes how a hardware wallet's screen-layout code handles the case where a user-interface layout has been closed or dropped earlier than expected. Previously the code would panic (crash). Now it returns a controlled RuntimeErr…

Replaces unwrap/panic with explicit error handling for dropped layout stateAdds new RuntimeError constant 'No layout' for graceful failureFollow-up to prior PR #7282, suggesting ongoing hardening of layout lifecycle
3c4c5ae1by Roman Zeyde+20−171 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →