I Built UpstreamWitness to Track What Happens After You Submit a Fix

Description and use

UpstreamWitness automatically tracks public upstream activity after a pull request, producing an evidence report and outcome classification.

Problem

After submitting a pull request, bounty fix, or public security report, it is hard to know if upstream actually incorporated the change, leading to uncertainty for researchers and contributors.

Outcome

UpstreamWitness provides a disciplined, automated way to assess whether upstream adopted a submitted fix, reducing uncertainty for security researchers and contributors.

Workflow

• 1. Run upstreamwitness trace-pr <PR‑URL> --out-dir <dir> to start a trace.
• 2. The tool collects public data: commits, PR state, releases, changed paths, symbols, keyword overlap, and review chronology.
• 3. It analyzes the data to determine one of four outcomes: UPSTREAM_CONFIRMED, STRONG_SIGNAL, POSSIBLE_SIGNAL, or NO_PUBLIC_SIGNAL.
• 4. The tool outputs a Markdown and JSON report summarizing the evidence and outcome.
• 5. Users review the report and, if needed, perform human verification of the evidence.

Evidence

UpstreamWitness is an open‑source public‑code evidence tracker for security researchers, bounty workers, and open‑source contributors.

Source

It then produces a Markdown and JSON evidence report.

Source

The tool does not claim correlation evidence is proof of attribution, bounty acceptance, legal entitlement, or payment.

Source