CommitWatch RSS
MZ
← Developer activityStrong match

Matthew Zipkin

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

54 commits2 monitored projects3 candidates0 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to Matthew ZipkinA visual map of monitored and externally discovered repositories.MZdeveloper52Bitcoin Core2LND
Monitored evidence

CommitWatch projects

Bitcoin CoreBitcoin Core52 commits3 candidates0 high riskLNDLightning Labs2 commits0 candidates0 high risk
External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Informational 23 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

doc: add release note describing change for forbidden clients

This commit only adds a release note documenting a prior behavior change: Bitcoin Core will now immediately drop remote clients blocked by the -rpcallowip setting, instead of sending them a '403 Forbidden' error page. The commit itself cha…

Behavior change in access-control enforcement for RPC/REST interfaceImmediate disconnection instead of 403 response reduces information leakage to unauthorized clientsNo code change in this commit; security relevance is documentary only
55d3cd51by Matthew Zipkin+6−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

http: check rpcallowip immediately after accepting connection

This Bitcoin Core change moves the IP allow-list check for RPC connections so it happens immediately when a connection is accepted, rather than after the server has already started processing the HTTP request. Previously, a blocked client …

Defense-in-depth: ACL enforcement moved earlier in connection lifecycleBehavior change: disallowed clients no longer receive an HTTP 403 response; connection is closed at accept timeRefactor of security-critical access-control state from global static to class member
d1ed2a6eby Matthew Zipkin+75−397 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: introduce a worker thread in http socket error test

This is a test-only change. It updates a single unit test file to run the HTTP request handler on a separate worker thread instead of handling it synchronously. There is no change to production code, no security fix, and no vulnerability.

b98b10c0by Matthew Zipkin+15−31 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: ensure HTTPServer race condition is fixed

This commit only changes a test file. It strengthens an existing test for the Bitcoin Core HTTP server so it can better catch a race condition where the server might stop reading new requests from a connection. The commit itself does not c…

Race condition in HTTP server request handlingPotential denial-of-service symptom: server stops reading from a socketTest-only change, not a production fix
f595daf1by Matthew Zipkin+29−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: socket error handling in HTTPServer using ErrorSock mock socket

This commit only adds new unit tests for the Bitcoin Core HTTP server. It creates a fake network socket that sometimes returns a 'try again' error, then verifies the server retries and still sends all replies. No production code is changed…

No changes to production/network codePure test-coverage addition for existing retry behaviorMock socket injection only reachable in unit tests
922b08d3by Matthew Zipkin+129−203 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

http: prevent race condition between worker thread and I/O thread

This commit fixes a subtle timing bug in Bitcoin Core's built-in HTTP server. Under a specific race between a worker thread preparing a response and the I/O thread sending data, a connection could get permanently stuck waiting to write eve…

Race condition between worker thread and I/O thread on shared statePotential denial-of-service via hung HTTP connectionLock ordering comment to prevent deadlock regression
73da2a8aby Matthew Zipkin+24−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

http: remove libevent usage from this subsystem

This commit removes the old libevent-based HTTP server code from Bitcoin Core and switches fully to a newer custom HTTP server implementation. It is a large cleanup/refactoring change, not a security patch. There is no indication in the co…

No security-relevant keywords in commit title or messageNo CVE, advisory, or security-fix references in commit messageDiff is purely removal of libevent integration and test updates
8c1eea07by Matthew Zipkin+21−6624 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

logging: deprecate libevent category

This commit removes support for the 'libevent' logging category in Bitcoin Core. It is a routine cleanup: the category is marked as deprecated, attempts to enable it are ignored with a warning, and it is excluded from the special 'all' log…

39e9099dby Matthew Zipkin+31−167 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

HTTPServer: disconnect after idle timeout (-rpcservertimeout)

This commit adds an idle timeout for HTTP connections to Bitcoin Core's RPC server. Previously, clients could stay connected indefinitely even when doing nothing. Now, after a configurable period of inactivity (default 30 seconds via -rpcs…

Adds idle connection timeout to limit resource consumption from idle clientsGuards against disconnecting clients mid-request via m_req_busy checkUses steady clock for timeout measurement
cbb8d1fbby Matthew Zipkin+44−42 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 35 · Opaque
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

HTTPServer: disconnect clients

This commit finishes the Bitcoin Core HTTP server's ability to actually close client connections. Before, several error paths had 'TODO: disconnect' comments, meaning misbehaving or finished clients could stay connected longer than intende…

Replaces multiple TODO: disconnect stubs with actual disconnection logicAdds HTTP 413 Content Too Large response and disconnect on oversized request bodiesAdds HTTP 400 Bad Request response and disconnect on request parse failures
a69bb9e1by Matthew Zipkin+125−344 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Allow http workers to send data optimistically as an optimization

This commit changes how Bitcoin Core's built-in HTTP server sends replies. Previously, worker threads always queued response data and told the main I/O loop to send it later. Now, if the send buffer is empty, the worker tries to push data …

Cross-thread state access: a worker thread now calls socket-send logic and sets flags previously managed by the I/O loopAtomic conversion of m_connection_busy indicates awareness of concurrent accessNo explicit security claims, CVE references, or bug-report attribution in commit or supplied references
5ef1b80aby Matthew Zipkin+21−62 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: split http_request_cb into libevent callback and dispatch

This is a pure code cleanup change. A single function that handles incoming HTTP requests was split into two functions: one that prepares the raw libevent request and wraps it, and another that performs the existing allow-checks and hands …

fec6b6bcby Matthew Zipkin+31−271 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 50 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

HTTPServer: implement control methods to match legacy API

This commit refactors how Bitcoin Core's built-in HTTP/RPC server is started and stopped. It adds new control functions (InitHTTPServer, StartHTTPServer, InterruptHTTPServer, StopHTTPServer) and makes shutdown more orderly by rejecting new…

New global server pointer and lifecycle functions for HTTP/RPC serverAdded graceful shutdown sequence with 30-second timeout and forced client cleanupAdded request-dispatcher mutex to protect dynamic handler replacement during shutdown
e5f242eeby Matthew Zipkin+178−62 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 65 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Add helper methods to HTTPRequest to match original API

This commit adds helper methods to Bitcoin Core's HTTP request handling so that newer internal code can mimic the older libevent-based API. The main functional change is a new, more tolerant URL query-parameter parser. It replaces a strict…

Relaxed input validation: malformed percent-encoding no longer raises an error and is returned to callers as raw data.Custom parser replaces mature library parser (libevent), increasing attack surface for URL parsing edge cases.New code uses std::string_view and pointer arithmetic to construct query substrings; bounds appear correct but are now project-maintained.
f946ff5aby Matthew Zipkin+116−123 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 60 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: switch http_libevent::HTTPRequest to http_bitcoin::HTTPRequest

This commit updates a fuzz test—a special automated test that feeds random data to a piece of code to find bugs. The test previously used Bitcoin Core's old libevent-based HTTP request parser and worked around a known crash in that parser.…

Removes a fuzz-test-only workaround for a libevent nullptr dereference in evhttp_parse_request_lineSwitches fuzzing target to the newer http_bitcoin HTTP parser implementationNo changes to production networking, consensus, or wallet code
e427c227by Matthew Zipkin+14−341 file
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

http: switch servers from libevent to bitcoin

This commit replaces Bitcoin Core's long-standing libevent-based HTTP server with a new custom-built HTTP server. The change is architectural, not a targeted bug fix. It alters how the node parses and rejects HTTP requests, which could cha…

Large-scale HTTP parser rewrite replacing a mature external library (libevent) with custom parsing codeChanges to request rejection semantics (status codes, header whitespace handling, duplicate Content-Length handling)Body size limit constant reduced/clarified from 0x02000000 to 32 MiB
21c7542cby Matthew Zipkin+44−588 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

define HTTP request methods at module level outside of class

This commit is a straightforward code cleanup: it moves the list of HTTP request methods (GET, POST, HEAD, PUT, UNKNOWN) out of a class and into a shared module-level type so two different parts of the codebase can use the same definitions…

dd11b5e0by Matthew Zipkin+45−365 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

HTTPServer: use a queue to pipeline requests from each connected client

This change reorders how Bitcoin Core's built-in web server handles multiple HTTP requests from the same connection. Previously, incoming requests could be handed off to worker threads as soon as they arrived, so a later, fast request migh…

Race condition mitigation: serializes per-client request handling to prevent out-of-order responsesState consistency: commit message explicitly cites risk of 'old state' being returned to later requestsHTTP/1.1 pipelining compliance: references RFC 7230 §6.3.2 response ordering requirement
7ee7df98by Matthew Zipkin+33−42 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: split HTTPBindAddresses into config parse and libevent setup

This commit is a simple code cleanup: it takes one function that did two jobs—reading RPC bind settings and actually opening network sockets—and splits it into two smaller functions. The behavior, settings, and warnings shown to users are …

2ca645c2by Matthew Zipkin+29−251 file
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →