CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
24Projects watched
17490Commits captured
17117AI analyses
88High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

17117 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/ethereum): rename and move keccak-related helper functions

This is a clean internal code cleanup in the Ethereum app of the Trezor firmware. It moves the Keccak hashing helper to a shared location and updates callers to use it. There is no user-facing behavior change and no security fix.

dc2aadf6by Roman Zeyde+35−467 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

pyln-proto: use coincurve 21 for python <=3.13 and add self-compiled wheels for python 3.14

This change updates how the project installs a cryptographic helper library called coincurve. The old pinned version was failing to build, so the team switched to a newer official version for most Python releases and, only for Python 3.14,…

Third-party package index introduced for Python 3.14 buildsSelf-compiled/pre-built wheels used instead of official upstream releaseDependency source moved from pinned Git commit to mutable registry versions
eb42ca93by daywalker90+101−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

docs: updated Arch linux source installation instructions

This commit only updates the Arch Linux installation instructions in the project's documentation. It replaces the older Poetry-based Python setup with the newer 'uv' tool, adds some system dependencies, and removes a section about Python p…

58863ab6by daywalker90+14−121 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

build-release: fix VERSION build-arg and add --no-push for the docker target

This is a build-script bug fix, not a security vulnerability. The release script for Core Lightning was failing to pass the version number into Docker builds, which caused the build to fail with a confusing git-related error. The patch als…

92fbf33dby ShahanaFarooqui+18−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: add lace wallet

This commit adds support for a new cryptocurrency wallet called 'Lace' to the Keystone hardware wallet firmware. It includes a new icon, a new entry in the wallet list, and logic to recognize Lace as a Cardano (ADA) and Bitcoin (BTC) walle…

1a46dcadby soralit+105−69 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: bump version

This commit only changes two version numbers in a header file: the build number goes from 0 to 1, and the beta flag goes from 1 to 4. It does not modify any executable code, fix any behavior, or address any security issue. It is a routine …

26df3782by soralit+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

Improve reliability of wait_and_check_bitcoind

This change is a reliability fix for how Core Lightning waits for the Bitcoin node (bitcoind) to be ready during startup. It replaces one long 30-second wait with 30 shorter 1-second retries to avoid cases where the connection check would …

No security-relevant code path modifiedNo input parsing or authentication logic changedNo memory safety defect evident in diff
cfb877a3by Nicolas Dorier+13−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

feat : add rtl language support with custom css (#7428)

This commit adds right-to-left (RTL) language support to BTCPay Server. It introduces metadata tracking for whether a language is RTL, fetches that flag from the translation manifest, stores it in the database, and switches the user interf…

8ba284ceby Tim+15530−2311 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

ui: keep frame during async processing

This commit fixes a visual glitch on the BitBox02 hardware wallet screen. During some asynchronous security operations, the screen briefly showed the 'waiting' screen between two user-interface steps, causing an annoying flash. The change …

UI-only change; no crypto, memory-safety, or access-control modificationsNew function `is_processing_request()` exposes runtime state but does not change trust boundariesScreen hold is bypassed when a screensaver or explicit component is present, preserving existing behavior
c6b1ffa3by benma's agent+168−79 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Reject existing Zcash batch signatures

This firmware update changes how Keystone hardware wallets handle Zcash batch signing. Previously, the device might have accepted a transaction request that already contained spend authorization signatures. Now it rejects such requests. Th…

Defensive input validation added to reject pre-existing spend authorization signatures in Zcash batch PCZT flowPotential host-supplied signature smuggling vector in batch signing mitigatedNew unit tests cover both Orchard and Ironwood pools for the rejection behavior
a50410acby Adam Tucker+126−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, moveonly: combine ipc_test.cpp and ipc_tests.cpp

This commit is a build-system and test-file reorganization. It merges two test files into one and adjusts CMake rules so the combined test compiles with the required library paths. There is no change to Bitcoin Core's runtime code, consens…

79494046by Ryan Ofsky+198−2156 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

ipc, refactor: Drop connect/listen/serve exe_name parameters

This is a straightforward internal code cleanup in Bitcoin Core's inter-process communication (IPC) layer. It moves the executable name parameter from individual connect/listen/serve methods into the protocol object's constructor. The exec…

33d37f3cby Ryan Ofsky+27−255 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →