CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
23Projects watched
16796Commits captured
968AI analyses
19High-risk findings · 30d
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

968 analyses
Highest risk·RSS
Moderate 66 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: detect RNG_SR_SEIS and RNG_SR_SECS, retry safely, and fail closed on persistent faults

This update fixes how the COLDCARD hardware wallet's random-number generator (RNG) handles rare hardware faults. Previously, the device could silently continue using weak or repeated random numbers if the RNG reported a seed error. Now it …

RNG seed-error flag detection added (RNG_SR_SEIS, RNG_SR_SECS)Bounded retry with recovery sequence instead of silent continuationFail-closed escalation on persistent RNG faults
82ced47aby scgbckbone+117−295 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

add a test for downgrading askrene datastore

This commit adds a regression test for Core Lightning's database downgrade path. It ensures that when a user downgrades from an upcoming v26.09 release to an older version (v26.06), the new 'impressions' data added by the askrene routing s…

Database downgrade path for new askrene schema (impressions table)Regression test only; no production code changeNo input validation, cryptography, network, or authorization changes
1818553eby Lagrang3+156−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

reject extended private keys when creating a terminal watch only wallet, and show import errors

This commit fixes a bug in Sparrow Wallet's terminal (command-line) watch-only wallet creation. Previously, a user could accidentally paste an extended private key (xprv) into a dialog meant only for public keys or output descriptors, and …

Prevents accidental import of extended private keys into watch-only wallet contextSurfaces previously swallowed import errors to the user via error dialogChanges exception handling from ImportException-only to all exceptions
fa0d4841by Craig Raw+19−152 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add bitbox02 attestation failed dialog

This commit adds a user-facing warning dialog when a BitBox02 hardware wallet fails an attestation check. Attestation is a process that helps verify the device is genuine and not a counterfeit or tampered unit. Previously, a failed attesta…

Adds explicit user warning for failed hardware wallet attestationPrevents repeated warning dialogs during device enumeration using AtomicBooleanWarns user not to store funds on potentially counterfeit device
1a810c06by Craig Raw+16−12 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

improve validation of payjoin proposals, and accept a substituted payment output where a change output is present

This commit strengthens how Sparrow Wallet checks Payjoin proposals received from a payment receiver. Payjoin lets a receiver add their own inputs to a transaction to improve privacy. The changes add missing checks that could previously le…

Added minimum fee-rate enforcement on Payjoin proposalsAdded Taproot (P2TR) key-path and derived-public-key validation and propagationRestricted payment-output substitution to proposals that retain a change output
32f7e58fby Craig Raw+250−233 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(python/trezorlib): enable entropy check on T1 by default

This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…

Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
a4af9107by Andrew Kozlik+10−42 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

rng: discard 12 words after SEIS clear per RM0432 32.3.7

This commit changes how the COLDCARD hardware wallet's random-number generator (RNG) recovers from a rare 'seed error' condition. The manufacturer is now following an STMicroelectronics guideline to throw away the first 12 random numbers a…

RNG recovery routine previously did not discard post-recovery outputNew behavior follows vendor reference-manual recommendation (RM0432 32.3.7)Randomness is used for cryptographic key material in a hardware wallet
43b21392by scgbckbone+33−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

remove unused signature verification results in satochip and keycard signers, note where signatures are verified

This commit removes leftover code that checked whether signatures from hardware card signers were valid, but then threw away the result. The signatures are still verified later by a different part of the wallet when the signed transaction …

Removal of local signature verification calls in hardware signer code pathsAdded comments documenting that signature verification occurs later via PSBT.verifyCombinedSignatures()Unused boolean results indicate the removed checks were dead code rather than active security controls
866e9893by Craig Raw+5−132 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 74 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

docs: why RNG clock errors don't invalidate RNG_DR

This commit only adds explanatory comments to two source files about why the COLDCARD firmware ignores certain hardware random-number-generator clock-error flags. It does not change any code behavior. The comments cite ST documentation say…

6e403982by scgbckbone+15−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: make device signing cases more granular

This commit only changes test code. It makes the automated test suite more flexible by letting device simulators opt out of one specific test case involving unusual key derivation paths, while still running the rest of the tests. There is …

eab5bad3by Sjors Provoost+19−97 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 80 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: remove insecure PRNG fallback

This commit removes a weak, predictable random-number generator that was bundled as a backup inside the firmware's SLIP-39 code. Previously, if the device's proper hardware random source was accidentally left out of a build, the firmware c…

Removal of deterministic LCG PRNG (random32)Removal of weak-symbol random_buffer fallbackRemoval of unused random helper APIs
17c78e30by ww3512687+108−693 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace hexlify with bytes.hex()

This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…

44aa469eby Martin Milata+1334−1383120 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →