CommitWatch RSS
JJ
← Developer activityVerified account

Jakub Janků

Public commit activity attributed with verified account confidence. This page describes observable work, not personal trustworthiness.

@jjanku on GitHub ↗
22 commits1 monitored projects9 candidates1 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to Jakub JankůA visual map of monitored and externally discovered repositories.JJdeveloper22Trezor firmware
Monitored evidence

CommitWatch projects

Trezor firmwareTrezor22 commits9 candidates1 high risk
External discovery

Other public projects

No external sample loaded yet.

Authenticated GitHub discovery can enrich this profile.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Low 39 AI analysisMessage 100 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(solana): migrate to off-chain message signing v1

This commit updates Trezor's Solana off-chain message signing feature from an older version (v0) to a newer version (v1). It changes how messages are packaged and sent to the device: instead of the computer app formatting the message and s…

Protocol version migration removes OCMS v0 parsing and envelope handlingFirmware now performs its own serialization of off-chain signing payloads, reducing trust in host-side formattingOld protobuf field 2 (raw OCMS v0 bytes) is reserved/deprecated
d289db4bby Jakub Janků+1378−150824 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): check owner in predefined flow

This update tightens a Solana staking flow in Trezor firmware so that the device now verifies the staking account is owned by the legitimate Stake program before showing the user a friendly confirmation screen. Previously, a crafted transa…

Missing input validation in a predefined transaction confirmation pathUI prompt could be shown for a transaction with an unexpected program ownerDefense-in-depth check added for Solana staking account owner
5d781accby Jakub Janků+11−72 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): show threshold on multisig init

This commit fixes a misleading display on Trezor hardware wallets when a user initializes a Solana multisig account. Previously, the device only showed the list of possible signers without showing how many signatures were actually required…

UI misrepresentation of authorization thresholdMissing display of critical multisig parameterPotential false sense of security for low-threshold multisigs
f5305c2fby Jakub Janků+28−83 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 76 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): show account owner to user

This update fixes a security gap in how Trezor displays Solana transactions. When creating or allocating a Solana account, the device now shows the 'owner' program that will control the new account. Before this change, a malicious owner co…

Missing security-critical UI field for account ownershipSocial-engineering / transaction-tampering vector via malicious owner programFunds-at-risk because CreateAccount instructions deposit lamports immediately
f3d5724fby Jakub Janků+33−33 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 97 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): show `source_account` when approving a delegate

This update fixes a display issue in Trezor's Solana token support. When a user approves a delegate (someone who can spend tokens on their behalf) using the older 'Approve' instruction, the device screen previously did not show which token…

UI display omission for sensitive authorization actionRisk of user approving unintended token account delegateFix aligns deprecated instruction UI with checked instruction UI
13abf4deby Jakub Janků+22−23 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): check unique stake withdraw recipient

This update fixes a display issue in Trezor's Solana staking withdrawal flow. Previously, when withdrawing staked SOL, the device could show only the total amount being withdrawn even if multiple different recipients were involved, and in …

UI flow could hide per-recipient amounts in multi-recipient stake withdrawalsMixed transactions could abort special flow after showing a warning, potentially without full user confirmationChangelog filed under .security category
31e05613by Jakub Janků+7−22 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(stellar): check parsed op count

This commit only changes a single test file. It adds strict=True to a zip() loop in a Stellar cryptocurrency test so that the test fails if the number of original and parsed operations do not match. There is no change to production firmwar…

c8966440by Jakub Janků+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(stellar): verify signatures in fixtures

This commit only changes a test file for Stellar cryptocurrency transaction signing. It adds a check that the expected signatures stored in test fixtures are mathematically valid, so that future tests don't accidentally treat a bad signatu…

test-only changefixture integrity verification addedno modification of signing implementation
8ea9cc20by Jakub Janků+7−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(stellar): merge test_xdr with test_sign_tx

This commit is a test-code cleanup only. It merges two Stellar-related test functions and adds a consistency check inside the main signing test. No production firmware code, cryptographic handling, or device behavior was changed. There is …

9a1ee9a3by Jakub Janků+16−171 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 88 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(stellar): properly bound string length

This commit fixes a length-check bug in Trezor's Stellar cryptocurrency support. The device was measuring string length in characters (Unicode code points) instead of bytes. Because some characters use multiple bytes, a string could pass t…

Incorrect input validation: length check used code-point count instead of byte countProtocol compliance mismatch with RFC 4506 XDR string encodingPotential to generate malformed or oversized Stellar transaction fields
888aa308by Jakub Janků+11−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): unify autolock duration formatting

This commit fixes a minor user-interface inconsistency in how the Trezor device displays auto-lock delays longer than a day. Previously, the confirmation dialog showed "48 hours" while the settings menu showed "2 days" for the same delay. …

No memory safety, cryptographic, or authorization changesNo input validation or parsing logic changesOnly string formatting and translation key renaming
28197f4dby Jakub Janků+105−13817 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/caesar): remove count limit in confirm_properties

This commit fixes a bug in the Trezor hardware wallet's Caesar UI layout where long lists of key-value properties (for example, transaction details shown on the device screen) could either crash debug builds or be silently cut off in produ…

Silent truncation of user-visible confirmation data in production buildsPanic/crash in debug builds on oversized property listsUI consistency fix aligning Caesar layout with other layouts
b235e018by Jakub Janků+5−192 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(solana): show message cosigner's index in UI

This commit is a small user-interface improvement for Trezor's Solana message signing feature. When a message has multiple cosigners, the device now shows each cosigner's position number on screen so the user can more easily tell them apar…

UI-only change: no cryptographic, parsing, or authorization logic modifiedNo new input handling, memory allocation, or trust boundary changesTest fixture hashes updated only for multi-signer Solana message tests, consistent with expected screen text change
241caaf8by Jakub Janků+49−492 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(solana): sign message with many cosigners

This commit only adds a new test case for Solana message signing with 64 cosigners and updates the expected screen snapshots used by automated testing. It does not change any firmware code that runs on the Trezor device, so it cannot intro…

e0b2dea3by Jakub Janků+25−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): move is_printable_ascii to common

This commit simply moves a small helper function that checks whether a string contains only normal printable characters from one file to another shared location. No behavior changes, no bug fixes, and no security implications are visible i…

e07fff7dby Jakub Janků+9−63 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(solana): sign and verify off-chain messages

This commit only adds new automated tests for a Solana feature that signs and verifies off-chain messages. It does not change the actual wallet firmware code that users rely on, so it cannot by itself introduce a security vulnerability or …

2124b6b3by Jakub Janků+514−34 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): break import cycle in types.py

This is a routine code cleanup that fixes a Python import cycle (two files importing each other) by moving one import to happen only when a specific function runs. There is no security-relevant change visible in the diff.

badee388by Jakub Janků+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 88 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(solana): add off-chain message signing

This commit adds a new Trezor feature: signing and verifying Solana off-chain messages. It is a feature implementation, not a fix for a known vulnerability. The code introduces new message types, parsing logic, user confirmation screens, a…

New signing code path added for Solana off-chain messagesParsing of attacker-controlled binary message/envelope format introducedUser confirmation flow added for off-chain message signing and verification
1d52d583by Jakub Janků+1439−8326 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 100 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(solana): support multisig transfer instruction

This commit updates the Trezor firmware's Solana support so that the standard 'Transfer' instruction can be used with multi-signature accounts. Previously, the firmware treated this instruction as non-multisig, which likely caused it to re…

Instruction metadata flag change for multisig supportNew test fixture for Solana multisig transferNo visible changes to signature verification or authorization logic
ad2a4443by Jakub Janků+142−26 files
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →