CommitWatch RSS
BB
← All projectsBitBox

BitBox02 firmware

Firmware and bootloader for BitBox02 signing devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

647 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

193security candidates127second-pass queue119AI analyses
28commits · 30 days
47commits · 60 days
312commits · 180 days
647commits · 365 days
Backfill bands
Aug 5 → Feb 6335 seen28 candidatesComplete
Feb 6 → Jun 6265 seen19 candidatesComplete
Jun 6 → Jul 619 seen5 candidatesComplete
Jul 6 → Aug 526 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

59/100 average clarity
65Strong · 80–100
281Adequate · 60–79
230Thin · 40–59
71Opaque · 0–39
23security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Marko Bencun39011773258
Niklas Dusenlund1112914059
benma's agent892818062
cedwies1254063
Tomas Vrba944074
Cedric Wiese1232049
Jad811062
thisconnect210072
benma211074
Niklas111035
Yasser Aziza111070
Patrick Steiger110045
Analysis record

Published AI watches

Last scanned 3 minutes ago

Low 39 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

rust: initialize C output buffers

This commit fixes a class of low-level memory-safety bugs where Rust code was given buffers containing uninitialized bytes. Rust's rules require every byte of a slice to be initialized, even if the function will overwrite them. Passing uni…

Undefined behavior at C/Rust FFI due to uninitialized buffers being treated as Rust slicesPotential optimizer-dependent behavior from violating Rust slice initialization rulesHardening of cryptographic output paths (SHA-256, HMAC-SHA256, HMAC-SHA512)
511018eaby benma's agent+52−2713 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

py: extract bootloader connection

This commit is a minor code cleanup in a Python helper script. It moves existing bootloader connection logic into a small nested helper function to satisfy a style checker (pylint's limit on the number of return statements). No behavior ch…

886113d0by benma's agent+10−61 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 69 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Limit SD erase file size

This commit fixes a bug in how the BitBox02 hardware wallet wipes files from its SD card. Before erasing a file, the device now checks the file's reported size against a safe maximum. Without this check, a tampered SD card could claim a fi…

CVE-2026-6682 referenced in commit messageMalformed FAT directory entry could cause excessive overwrite loopDenial-of-service via SD card tampering
2453f528by Marko Bencun+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 70 AI analysisMessage 66 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Validate mounted FAT geometry

This update adds a safety check when the BitBox02 hardware wallet mounts a microSD card. A malicious or deliberately malformed FAT filesystem could trick the device's file-system library into placing user data inside attacker-controlled bo…

Fixes integer-wrap / geometry confusion in FAT mount logicAdds explicit post-mount validation of filesystem metadataPrevents data area from landing inside attacker-controlled FAT sectors
01c017d6by Marko Bencun+21−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 59 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

api: add BitBoxSync

This commit adds a brand-new firmware feature called BitBoxSync, which lets the BitBox02 hardware wallet participate in a sync service by proving its identity, signing login/admin intents, and decrypting namespace encryption keys. The code…

New cryptographic API surface added to the hardware wallet (Ed25519, X25519, HKDF, AEAD)Vendored third-party crate `hkdf` introduced into the firmware supply chainNew user-confirmation flow for signing sync intents; one operation (UnwrapNamespaceDek) deliberately skips confirmation
54cdb54dby Marko Bencun+2883−2230 files
No security note in commit
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: update stage1 binaries to v1.2.2

This commit simply swaps in newer pre-built bootloader stage1 binary files (version 1.2.2 replacing 1.2.1) for four BitBox02 hardware variants and updates the corresponding checksum list. The actual code inside the new binary files is not …

5940a800by Marko Bencun+8−86 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader/stage1: fix erase handling for partially erased blocks

This update fixes the BitBox02 bootloader's firmware-erase routine. Previously, when erasing leftover padding after a firmware update, the bootloader started erasing at the exact page where the firmware ended. Because flash memory can only…

Bootloader firmware erase routine could erase a flash block containing both firmware and paddingFix aligns erase start to erase-block boundary and re-checks erased state before erasingChangelog describes the change as a fix for 'partially erased flash blocks'
b31206a8by Marko Bencun+23−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: add stage0/stage1 production binaries

This commit adds production bootloader upgrade files for the BitBox02 hardware wallet and updates build scripts to use them. It is a routine asset-management change: replacing placeholder development hashes with real signed production bina…

8db4b0dcby Marko Bencun+26−1720 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 83 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: keep dev stage1 unsigned

This commit fixes a build script used only for development/testing versions of the BitBox02 bootloader upgrade. It makes the development-stage1 bootloader images unsigned again, while keeping production images fully signature-verified. The…

Signature verification relaxed only for development buildsProduction payload validation still requires signaturesDevelopment stage0 already skipped stage1 signature verification per commit message
476b90e3by Marko Bencun+9−69 files
No security note in commit
Open full analysis →Source commit ↗
High 76 AI analysisMessage 23 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

security improvements

This BitBox02 firmware update is a broad security patch that fixes several independent bugs: it prevents a maliciously oversized USB report from overflowing memory, stops a corrupted Bluetooth pairing database from being read or written wi…

Bounds check added to USB HID Set Report input lengthBLE bond DB length validation hardened against negative and oversized valuesBootloader firmware image size limit relaxed to intended maximum
cbb40634by Marko Bencun+1117−25021 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 60 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: allow full sized images

This commit fixes a bootloader bug where the device rejected firmware updates that used the maximum allowed size. The off-by-one check meant legitimate full-sized firmware images could not be installed, potentially blocking updates. The fi…

Off-by-one input validation in firmware-update pathBootloader change affecting firmware chunk count acceptanceCHANGELOG labels the change as a bugfix for full-sized firmware upgrades
f60b93ccby Marko Bencun+5−33 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 28 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Add bootloader update

This is a large firmware commit that adds a new two-stage bootloader update mechanism for the BitBox02 hardware wallet. It replaces the old single bootloader with a small, fixed 'stage0' plus a separately signed 'stage1', and ships a speci…

Bootloader architecture changed from monolithic to two-stage (stage0 + signed stage1).Firmware signature hash now includes a 16-bit product_id, binding firmware to product variant.Root public keys were rotated/replaced with a single set across all products.
3f1f3172by Marko Bencun+5003−52379 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Add flash data backup scripts

This commit adds two helper scripts for developers to back up and restore BitBox02 flash memory areas using a Segger J-Link debugger. The scripts require physical hardware access and a debugging probe, and they are not part of the firmware…

285fa768by Niklas Dusenlund+383−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bb03 UI: placeholder BTC signing workflows

This commit replaces unfinished placeholder code (which would crash with 'todo!()') with simple working user-interface placeholders for Bitcoin signing demonstrations. It adds basic on-screen prompts to confirm a recipient/amount and a tot…

f7b0b082by Jad+24−121 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 78 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Bump Rust toolchain to 1.96

This commit is a routine maintenance update for the BitBox02 hardware wallet firmware. It upgrades the pinned Rust compiler toolchain from an older version to Rust 1.96.0, updates the project's Docker build container and related developer …

Routine toolchain and dependency upgradeVendored libc updated across many platform bindingsNo first-party security-relevant code changes
55e3dd30by Niklas Dusenlund+14839−13798360 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: reduce snprintf

This commit removes the use of the standard snprintf formatting function from the BitBox02 bootloader's developer menu and replaces it with a small, fixed-format helper. The main goal is to reduce the bootloader's binary size and make the …

Removes snprintf/printf usage from bootloader code, reducing binary bloat and eliminating a complex formatting library from a privileged execution contextExtends automated CI check to detect stdio/Rust formatting symbols in regular development and production bootloader outputs, not just production buildsAdds unit test coverage for the new fixed-format helper
2fb9d57fby Marko Bencun+59−106 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: hash BLE firmware in C

This commit is a code-size optimization for the BitBox02 bootloader. It switches the Bluetooth Low Energy (BLE) firmware hash verification from a Rust SHA-256 implementation to an existing C-based SHA-256 implementation already used by the…

Change is described by the vendor as a size optimization, not a security fix.No functional change to the hash verification logic: SHA-256 digest is still computed and compared against metadata.allowed_firmware_hash.CI check added to enforce use of the smaller PUKCC SHA-256 path in production bootloaders.
1d82b8a4by Marko Bencun+18−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 63 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: avoid snprintf formatting

This commit removes the use of standard string-formatting functions (like snprintf and Rust's format!) from the bootloader and related low-level code, replacing them with smaller, fixed-size string builders. The stated goal is to reduce bi…

Removal of stdio formatting (snprintf family) from bootloader codeRemoval of Rust format!/write! formatting from bootloader-linked codeAddition of CI gate rejecting stdio and Rust formatting symbols in production bootloader ELFs
33434fa9by Marko Bencun+298−6314 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: extract formatting helpers

This commit is a simple code cleanup: it moves a handful of string-formatting helpers (for pairing codes, progress percentages, hash display, timers, and unknown-command messages) out of the main bootloader file into a new dedicated file, …

1a1de3b5by Marko Bencun+147−126 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 58 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: render messages directly

This commit removes a 100-character stack buffer and passes bootloader messages straight to the screen-drawing function. The old code used snprintf to copy the message into a fixed-size buffer, which could silently truncate very long strin…

Removal of fixed-size stack buffer in bootloader display pathElimination of snprintf with potentially attacker-influenced format string argumentBootloader code touched, which is a security-sensitive component
c0bc7b92by Marko Bencun+1−31 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedhal/ui: remove show_and_confirm_mnemonicby Marko Bencun · 923eb529 · Feb 18, 2026 · 5 filesMessage 35 · OpaqueTriage 0Details
Commit message · Marko Bencun

hal/ui: remove show_and_confirm_mnemonic

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedbitbox02_rust/hal: add ui trinary choiceby Marko Bencun · 2337a52a · Feb 18, 2026 · 5 filesMessage 78 · AdequateTriage 0Details
Commit message · Marko Bencun

bitbox02_rust/hal: add ui trinary choice

Introduce hal::ui::TrinaryChoice and remove direct dependency on bitbox02::ui::TrinaryChoice in HAL consumers.

Add exhaustive conversion tests in hal::bitbox02::ui for to_hal_trinary_choice.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedbitbox02_rust: move workflow::confirm::UserAbort to hal::uiby benma's agent · 15394330 · Feb 18, 2026 · 13 filesMessage 65 · AdequateTriage 12Details
Commit message · benma's agent

bitbox02_rust: move workflow::confirm::UserAbort to hal::ui

We want to make the HAL self-contained so it can be moved to a new crate bitbox-hal.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedbitbox02_rust: drop workflow::transaction::UserAbort for hal::ui::UserAbortby benma's agent · 12c98288 · Feb 18, 2026 · 5 filesMessage 65 · AdequateTriage 12Details
Commit message · benma's agent

bitbox02_rust: drop workflow::transaction::UserAbort for hal::ui::UserAbort

We want to make the HAL self-contained so it can be moved to a new
crate bitbox-hal.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedbitbox02_rust/ui: inline verify_total_feeby Marko Bencun · 24adc280 · Feb 18, 2026 · 2 filesMessage 50 · ThinTriage 12Details
Commit message · Marko Bencun

bitbox02_rust/ui: inline verify_total_fee

Inline total-fee confirmation into the BB02 HAL UI and remove
the redundant transaction wrapper.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedbitbox02_rust/ui: inline verify_recipientby Marko Bencun · b080eada · Feb 18, 2026 · 2 filesMessage 50 · ThinTriage 12Details
Commit message · Marko Bencun

bitbox02_rust/ui: inline verify_recipient

Inline recipient confirmation into the BB02 HAL UI and remove
the redundant transaction wrapper.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedeth: use hex! instead of bytestring literalsby Marko Bencun · d6d96e66 · Feb 18, 2026 · 3 filesMessage 45 · ThinTriage 12Details
Commit message · Marko Bencun

eth: use hex! instead of bytestring literals

For readability.

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queueduse new executor for u2f futuresby Niklas Dusenlund · 858bbce2 · Feb 17, 2026 · 23 filesMessage 60 · AdequateTriage 0Details
Commit message · Niklas Dusenlund

use new executor for u2f futures

Co-Authored-By: Marko Bencun <marko@shiftcrypto.ch>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedui: port status to asyncby Marko Bencun · f08c87ca · Feb 15, 2026 · 4 filesMessage 38 · OpaqueTriage 0Details
Commit message · Marko Bencun

ui: port status to async

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedeth: switch sighash to dyn dispatchby Marko Bencun · aad56de5 · Feb 14, 2026 · 2 filesMessage 68 · AdequateTriage 12Details
Commit message · Marko Bencun

eth: switch sighash to dyn dispatch

Firmware size (build/bin/firmware.bin, clean build).
Before: 707204 bytes (previous commit).
After: 705428 bytes.
Saved: 1776 bytes.
Cumulative vs e217ae3a: 3240 bytes.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedeth: unify sighash data producerby Marko Bencun · 06454b29 · Feb 14, 2026 · 2 filesMessage 68 · AdequateTriage 12Details
Commit message · Marko Bencun

eth: unify sighash data producer

Firmware size (build/bin/firmware.bin, clean build).
Before: 708668 bytes (e217ae3a).
After: 707204 bytes.
Saved: 1464 bytes.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedeth: extract eth sighash test data into jsonby Tomas Vrba · bfc22b42 · Feb 13, 2026 · 13 filesMessage 70 · AdequateTriage 12Details
Commit message · Tomas Vrba

eth: extract eth sighash test data into json

extracts the go scripts that generate eth sighash test data into a
standalone go script and commits generate json data

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedeth: implement data producer for streamingby Tomas Vrba · 5c39f840 · Feb 13, 2026 · 2 filesMessage 80 · StrongTriage 12Details
Commit message · Tomas Vrba

eth: implement data producer for streaming

Implements the DataProducer trait with two implementations:
- SimpleProducer: Returns all data in one call (for small data)
- ChunkingProducer: Fetches data in 4096-byte chunks via IPC (for large data)

Updates DataProducer::next() to return Result<Option<Vec<u8>>, Error>
instead of Option<Vec<u8>> for proper error handling.

Updates sighash computation functions (compute_legacy, compute_eip1559) to:
- Accept DataProducer via RefCell for async access
- Propagate errors through the call chain
- Use the Write trait to stream data into the hasher

Updates sign.rs hash functions to use ChunkingProducer when
data_length > 0, otherwise use SimpleProducer with inline data.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedeth: make sighash computation streaming/asyncby Marko Bencun · 65be9d60 · Feb 13, 2026 · 2 filesMessage 78 · AdequateTriage 12Details
Commit message · Marko Bencun

eth: make sighash computation streaming/async

So it can handle ETH transactions with very large data fields that
can't be sent by the host in one USB packet.

The Go code to produce the tests has been adjusted to work with the
updated go-ethereum package, and to output the data using the
`SimpleProducer`.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedui: drop Component lifetime markerby benma's agent · 2199c28d · Feb 13, 2026 · 4 filesMessage 60 · AdequateTriage 12Details
Commit message · benma's agent

ui: drop Component lifetime marker

All callbacks are gone, so not needed anymore.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedui: port tx fee confirm to asyncby Niklas Dusenlund · c7c875c9 · Feb 12, 2026 · 4 filesMessage 80 · StrongTriage 12Details
Commit message · Niklas Dusenlund

ui: port tx fee confirm to async

Port confirm_transaction_fee_create() to async/await.

Note: remove Component::on_drop because all component constructors now
set it to None, so the field and drop callback path are dead code.

Co-Authored-By: Marko Bencun <marko@shiftcrypto.ch>

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedui: port tx address confirm to asyncby Niklas Dusenlund · a33e1d5d · Feb 12, 2026 · 5 filesMessage 60 · AdequateTriage 12Details
Commit message · Niklas Dusenlund

ui: port tx address confirm to async

Co-Authored-By: Marko Bencun <marko@shiftcrypto.ch>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queueddocstring typoby Marko Bencun · 2590e08c · Feb 12, 2026 · 1 fileMessage 18 · OpaqueTriage 0Details
Commit message · Marko Bencun

docstring typo

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedfix: validate max_fee_per_gas zero prefix in EIP-1559by cedwies · ee6e1cee · Feb 11, 2026 · 1 fileMessage 62 · AdequateTriage 20Details
Commit message · cedwies

fix: validate max_fee_per_gas zero prefix in EIP-1559

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
defensive validationsigning or wallet pathsecond-pass: near security thresholdsecond-pass: security-sensitive path
AI review queuedinital async-engineby Niklas Dusenlund · a4a2fc1d · Feb 9, 2026 · 95 filesMessage 43 · ThinTriage 0Details
Commit message · Niklas Dusenlund

inital async-engine

ports orientation screen and delay to show that waking works

Co-Authored-By: Marko Bencun <marko@shiftcrypto.ch>

43/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedda14531: avoid unaligned u16 loadsby benma's agent · 043ad352 · Feb 3, 2026 · 1 fileMessage 68 · AdequateTriage 7Details
Commit message · benma's agent

da14531: avoid unaligned u16 loads

The serial-link frame buffer is byte-addressed. Casting &frame[1] /
&frame[3+len] to a uint16_t* can be unaligned, which is undefined
behavior in C.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedda14531: drop too-short UART framesby benma's agent · 9d57db92 · Feb 3, 2026 · 1 fileMessage 68 · AdequateTriage 7Details
Commit message · benma's agent

da14531: drop too-short UART frames

The serial-link parser subtracts 5 bytes (type+len+crc) when
validating a frame. If a truncated frame reaches
SERIAL_LINK_STATE_CHECK with frame_len < 5, the subtraction
underflows, allowing out-of-bounds reads during CRC/length handling.

Reject frames shorter than the minimum header+CRC size before parsing
the length.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedpy: formatby Niklas Dusenlund · aae1c599 · Feb 3, 2026 · 1 fileMessage 0 · OpaqueTriage 0Details
Commit message · Niklas Dusenlund

py: format

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedbitbox02: port C datetime formatting to Rustby benma's agent · 1a04855e · Feb 2, 2026 · 148 filesMessage 68 · AdequateTriage 0Details
Commit message · benma's agent

bitbox02: port C datetime formatting to Rust

Using the `time` dep. Binary size becomes slightly smaller.

Squashed: move bitbox02 datetime funcs to util::datetime

It is not Rust-based and not related to BitBox02 hardware
functionality, so we move it to the util crate.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: unusually broad change
AI review queuedInitial bb03 simulatorby Niklas Dusenlund · 7be0d9e7 · Jan 30, 2026 · 11 filesMessage 28 · OpaqueTriage 0Details
Commit message · Niklas Dusenlund

Initial bb03 simulator

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message