CommitWatch RSS
CK
← All projectsCoinkite

COLDCARD firmware

Open-source firmware for COLDCARD Bitcoin signing devices.

BitcoinHardware walletsActive incident
Source repository ↗
Repository coverage

306 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

70security candidates169second-pass queue32AI analyses
25commits · 30 days
74commits · 60 days
158commits · 180 days
306commits · 365 days
Backfill bands
Aug 5 → Feb 6148 seen2 candidatesComplete
Feb 6 → Jun 684 seen8 candidatesComplete
Jun 6 → Jul 649 seen4 candidatesComplete
Jul 6 → Aug 525 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

29/100 average clarity
1Strong · 80–100
17Adequate · 60–79
103Thin · 40–59
185Opaque · 0–39
34security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Peter D. Gray146208215
scgbckbone1464823039
Dmitry Monakhov211073
kdmukai110050
tadeubas600051
dependabot[bot]300079
russeree100060
nvk10000
Analysis record

Published AI watches

Last scanned 44 minutes ago

Moderate 66 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: detect RNG_SR_SEIS and RNG_SR_SECS, retry safely, and fail closed on persistent faults

This update fixes how the COLDCARD hardware wallet's random-number generator (RNG) handles rare hardware faults. Previously, the device could silently continue using weak or repeated random numbers if the RNG reported a seed error. Now it …

RNG seed-error flag detection added (RNG_SR_SEIS, RNG_SR_SECS)Bounded retry with recovery sequence instead of silent continuationFail-closed escalation on persistent RNG faults
82ced47aby scgbckbone+117−295 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

rng: discard 12 words after SEIS clear per RM0432 32.3.7

This commit changes how the COLDCARD hardware wallet's random-number generator (RNG) recovers from a rare 'seed error' condition. The manufacturer is now following an STMicroelectronics guideline to throw away the first 12 random numbers a…

RNG recovery routine previously did not discard post-recovery outputNew behavior follows vendor reference-manual recommendation (RM0432 32.3.7)Randomness is used for cryptographic key material in a hardware wallet
43b21392by scgbckbone+33−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 74 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

docs: why RNG clock errors don't invalidate RNG_DR

This commit only adds explanatory comments to two source files about why the COLDCARD firmware ignores certain hardware random-number-generator clock-error flags. It does not change any code behavior. The comments cite ST documentation say…

6e403982by scgbckbone+15−02 files
No security note in commit
Open full analysis →Source commit ↗
Critical 91 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

fixes rng

This commit fixes a critical random-number bug in COLDCARD hardware wallets. The device was accidentally using a weak, software-based fallback random generator instead of its secure hardware one when creating Bitcoin seed phrases. Because …

Weak/fallback PRNG silently linked in place of hardware RNGSeed phrase entropy reduction allowing private-key recoveryBuild-system override of upstream rng.o with empty object
ca724637by Peter D. Gray+60−711 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

limit BIP-322 msg length to 330 chars

This commit adds a 330-character limit to BIP-322 proof-of-reserve messages on the COLDCARD hardware wallet. Without the limit, an attacker could craft a very long message that might be used to mislead the user, overflow display buffers, o…

Input length bound added to user-facing signed messageAssertion failure prevents processing of oversized messagesEmpty message already rejected; documentation now also requires non-empty message
b29d2347by scgbckbone+41−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

apply note or pwd as b39 passphrase

This commit adds a new feature to the COLDCARD hardware wallet that lets users apply the text of a Secure Note or the value of a Secure Note password as their BIP-39 wallet passphrase. It also tightens how printable ASCII is checked in a f…

New feature exposes stored Secure Notes / Passwords as BIP-39 passphrasesInput validation relies on length, printable-ASCII, and rstrip of trailing whitespace/tab/newlineRefactored text sanitization changes control-flow for message signing and PSBT message warnings
0ef6413cby scgbckbone+223−289 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 73 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix BBQr share of Unicode text: encode str to UTF-8 before sizing/splitting

This commit fixes a bug in the COLDCARD Q1 hardware wallet where displaying certain QR codes containing non-English or special characters could cause the device to crash with an assertion failure. The fix ensures text is converted to UTF-8…

Assertion failure/crash in QR display pathLength mismatch between codepoints and UTF-8 bytesDenial-of-service-like symptom (device crash on user data display)
97d86c95by Dmitry Monakhov+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 18 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: p2pk

This commit fixes a bug in the COLDCARD hardware wallet that prevented it from correctly signing Bitcoin transactions that spend from 'pay-to-public-key' (P2PK) outputs. P2PK is an older, uncommon output type where coins are locked directl…

Bugfix explicitly described in release notes as 'P2PK signing was broken'P2PK scriptPubKey parsing now supports both compressed and uncompressed public keysPubkey comparison logic corrected for uncompressed P2PK keys
0d04e5e1by scgbckbone+268−328 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

WIF Store upgrade

This commit upgrades the COLDCARD firmware's WIF Store feature so that individual private keys imported as WIF can sign transactions even when the PSBT file lacks the usual BIP-32 key-path metadata. It adds address/scriptPubKey auto-detect…

Signing path now accepts PSBT inputs with no BIP-32 derivation data if a matching WIF-store pubkey is foundSynthetic subpaths with zero fingerprint are injected for WIF-matched inputsRemoved assertion that key paths must be at least depth 8 (vl >= 8)
1dddd885by scgbckbone+717−849 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

BIP-322 changes after BIP got in to the complete state

This commit updates COLDCARD's BIP-322 (Bitcoin message signing / proof-of-reserves) implementation to match the finalized BIP-322 specification. The main user-visible change is that the message to be signed must now be embedded directly i…

BIP-322 message now embedded in PSBT and verified against reconstructed to_spend, reducing reliance on external/user-supplied message filesBIP-322 PSBTs are explicitly prevented from being finalized into broadcastable transactionsHSM policy now applies message-signing path restrictions to BIP-322 PSBTs
d656f371by scgbckbone+1106−61015 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

docs: index all docs and fix drift vs firmware

This commit is purely a documentation update. It adds missing entries to the docs index, updates outdated examples and menu trees, fixes a broken filename reference in a code comment, and corrects factual details (such as supported models …

8e3bbfdfby scgbckbone+139−8315 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bundle small fixes

This is a large bundle of bug fixes for the COLDCARD hardware wallet firmware. Most changes fix user-interface crashes ('yikes'), incorrect error messages, or policy edge cases rather than a single critical vulnerability. The most security…

HSM mode now disables NFC and Virtual Disk peripherals to reduce USB/NFC attack surfaceSingle-Signer Spending Policy unlock no longer accepts a zero-secret bypass PIN as the 'main PIN'OP_RETURN and non-standard scripts are no longer hidden as 'null-data' during transaction review
c36eac23by scgbckbone+1486−28548 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 35 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

final solution can_cancel=True

This commit changes how number-entry prompts behave across the COLDCARD wallet interface. Previously, many prompts did not allow the user to cancel, so pressing the cancel button could be misread as entering '0' and the operation would con…

Default behavior change: numeric entry dialogs now allow cancellation by defaultMultiple sensitive flows no longer treat cancel as confirmation/default valueNew regression tests assert cancel preserves prior menu state
300323f1by scgbckbone+114−4913 files
No security note in commit
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: Delta Mode Trick PIN restore from backup

This commit fixes a bug where a special security feature called 'Delta Mode Trick PIN' was not being restored when a user restored their Coldcard wallet from a backup. A Trick PIN is a decoy PIN that can do things like show a fake wallet o…

Functional bug in security feature (Trick PIN restore)Silent failure due to bare exception handlerMismatch between function return value and caller (tuple unpack)
be614dabby scgbckbone+235−1306 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 18 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

new bootloader

This commit adds a new pre-built bootloader release (version 3.3.0) for the COLDCARD Mk4 hardware wallet. It consists of binary firmware files and a hash manifest, plus a disassembly listing. There is no source code change, no vulnerabilit…

02b5a756by Peter D. Gray+34698−05 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Mk hardware

This commit adds support for a new COLDCARD hardware revision, the Mk5. It is a routine product-enablement patch: it teaches the firmware, bootloader, build system, simulator, and signing tools to recognize and run on Mk5 devices. There is…

No security-relevant signals detected in the diff.Change is hardware bring-up / product enablement only.No fixes for memory corruption, authentication bypass, cryptographic flaws, or privilege escalation.
38553d1aby Peter D. Gray+728−27643 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

WIF Store

This commit adds a new 'WIF Store' feature to the COLDCARD firmware. It lets users import external Bitcoin private keys (in WIF format) and use them to sign PSBT transactions and messages, alongside the device's normal seed-derived keys. T…

New feature adds persistent storage of arbitrary private keys in device settingsPSBT signing path now branches on whether a required pubkey is in the WIF storeAddress ownership verification now recognizes WIF-store addresses as 'ours'
9b131b2eby scgbckbone+1243−8222 files
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: do not offer to show QR code of TXID if txn is not finalized

This commit fixes a small user-interface bug in the COLDCARD hardware wallet. Previously, after signing a transaction that was not yet finalized, the device still offered a menu option to display a QR code of the transaction ID (TXID). Bec…

UI-only bugfix with no cryptographic or authorization bypassPrevents display of potentially invalid/incomplete TXID QR code before transaction finalizationNo buffer overflow, injection, or privilege escalation signals in diff
c19be4f4by scgbckbone+20−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

MSG->Message when we have space

This commit only changes user-facing text labels in the COLDCARD firmware. It expands the abbreviation 'MSG' to 'Message' on screens that have enough space, and updates the corresponding automated tests to match the new wording. There is n…

a3d5d615by Peter D. Gray+10−92 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

BIP-322 Proof of Reserves

This commit adds support for BIP-322 Proof of Reserves signing on COLDCARD hardware wallets. It lets users prove they control certain Bitcoin addresses by signing a special non-spending transaction, without actually moving funds. The chang…

New transaction parsing path accepts nVersion=0 under a specific POR heuristicPOR detection relies on a single zero-amount OP_RETURN output (scriptPubKey == b'\x6a')POR validation parses and constrains the embedded 'to_spend' transaction from the 0th input's non-witness UTXO
5d7d5d88by scgbckbone+816−157 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityfix bypass_tmp return to master secret with xprv typeby scgbckbone · 67a5c6c2 · Jun 24, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · scgbckbone

fix bypass_tmp return to master secret with xprv type

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidatefix testsby scgbckbone · eb112eb3 · Jun 24, 2026 · 2 filesMessage 0 · OpaqueTriage 15Details
Commit message · scgbckbone

fix tests

0/100 · OpaqueMessage clarity
✓ Mentions testing or verification! Very short subject! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive path
Security candidatebugfix: p2pkby scgbckbone · 0d04e5e1 · Jun 23, 2026 · 8 filesMessage 18 · OpaqueModerate 57Details
Commit message · scgbckbone

bugfix: p2pk

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
signing or wallet pathauthentication path
AI analysis · Moderate 57/100

This commit fixes a bug in the COLDCARD hardware wallet that prevented it from correctly signing Bitcoin transactions that spend from 'pay-to-public-key' (P2PK) outputs. P2PK is an older, uncommon output type where coins are locked directly to a public key rather than to a Bitcoin address. The bug meant P2PK signing was broken entirely, and the device could not handle both compressed (33-byte) and uncompressed (65-byte) public key forms. The fix updates the firmware to recognize both key lengths, compare them correctly against derived keys, and produce the right transaction signature format. It also adds tests that exercise real P2PK spends against Bitcoin Core.

AI review queuedReject witness-only UTXO for legacy inputs; Suppress fee for unverified witness UTXOs;normalize legacy inputs to proper utxoby scgbckbone · 59eb529a · Jun 23, 2026 · 6 filesMessage 50 · ThinTriage 12Details
Commit message · scgbckbone

Reject witness-only UTXO for legacy inputs; Suppress fee for unverified witness UTXOs;normalize legacy inputs to proper utxo

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedimprove USB validationby scgbckbone · d5aba396 · Jun 23, 2026 · 4 filesMessage 28 · OpaqueTriage 0Details
Commit message · scgbckbone

improve USB validation

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedbugfix: 1of1 multisigby scgbckbone · 6fd256db · Jun 23, 2026 · 4 filesMessage 28 · OpaqueTriage 12Details
Commit message · scgbckbone

bugfix: 1of1 multisig

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
Lower-prioritykeep NFC export tag live for repeated probesby scgbckbone · 6716fcba · Jun 23, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · scgbckbone

keep NFC export tag live for repeated probes

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidateWIF Store upgradeby scgbckbone · 1dddd885 · Jun 22, 2026 · 9 filesMessage 28 · OpaqueLow 40Details
Commit message · scgbckbone

WIF Store upgrade

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
signing or wallet pathauthentication path
AI analysis · Low 40/100

This commit upgrades the COLDCARD firmware's WIF Store feature so that individual private keys imported as WIF can sign transactions even when the PSBT file lacks the usual BIP-32 key-path metadata. It adds address/scriptPubKey auto-detection, descriptor export, and Electrum-style watch-only wallet support. The change is primarily a feature enhancement, but it touches sensitive signing paths and removes a previous safety assertion that required key paths to be at least depth 8, which slightly weakens one guardrail.

Security candidateBIP-322 changes after BIP got in to the complete stateby scgbckbone · d656f371 · Jun 22, 2026 · 15 filesMessage 50 · ThinLow 43Details
Commit message · scgbckbone

BIP-322 changes after BIP got in to the complete state

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet pathauthentication pathparser or protocol path
AI analysis · Low 43/100

This commit updates COLDCARD's BIP-322 (Bitcoin message signing / proof-of-reserves) implementation to match the finalized BIP-322 specification. The main user-visible change is that the message to be signed must now be embedded directly in the PSBT file under a new standard field, instead of being imported separately by the user. The device verifies that the embedded message matches the on-screen message before signing. The change also adds HSM policy checks so BIP-322 signing is governed by message-signing rules, and it prevents BIP-322 PSBTs from being finalized into broadcastable transactions. There is no obvious vulnerability introduced; it is primarily a standards-compliance and safety hardening patch.

Lower-priorityRestore borrowed secret handling in SensitiveValuesby scgbckbone · 7e92e516 · Jun 22, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · scgbckbone

Restore borrowed secret handling in SensitiveValues

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedstabilize testsby scgbckbone · 74d34cfc · Jun 22, 2026 · 5 filesMessage 28 · OpaqueTriage 12Details
Commit message · scgbckbone

stabilize tests

28/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
Lower-prioritysimulator:attribute catchup with real SCANby scgbckbone · 64658621 · Jun 22, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · scgbckbone

simulator:attribute catchup with real SCAN

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritydocs: NFC antenna by HWby scgbckbone · 755353f0 · Jun 22, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · scgbckbone

docs: NFC antenna by HW

50/100 · ThinMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritybuild: automatic block height updateby scgbckbone · 2981d159 · Jun 22, 2026 · 6 filesMessage 57 · ThinTriage 0Details
Commit message · scgbckbone

build: automatic block height update

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityslight menu optimization for long menusby scgbckbone · 9ff3f5c4 · Jun 19, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · scgbckbone

slight menu optimization for long menus

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedtest nitsby scgbckbone · f5a1ef32 · Jun 19, 2026 · 4 filesMessage 0 · OpaqueTriage 12Details
Commit message · scgbckbone

test nits

0/100 · OpaqueMessage clarity
✓ Mentions testing or verification! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
Security candidatetesting: block_h bumped for SSSP too, when CCC overrides SSSP blockby scgbckbone · 841e4433 · Jun 19, 2026 · 4 filesMessage 60 · AdequateTriage 10Details
Commit message · scgbckbone

testing: block_h bumped for SSSP too, when CCC overrides SSSP block

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
authentication path
AI review queuedtesting: cope with bitcoin core v30by scgbckbone · 38616234 · Jun 19, 2026 · 2 filesMessage 55 · ThinTriage 12Details
Commit message · scgbckbone

testing: cope with bitcoin core v30

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Security candidatedocs: index all docs and fix drift vs firmwareby scgbckbone · 8e3bbfdf · Jun 19, 2026 · 15 filesMessage 57 · ThinInformational 15Details
Commit message · scgbckbone

docs: index all docs and fix drift vs firmware

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
seed or entropy pathsigning or wallet pathauthentication path
AI analysis · Informational 15/100

This commit is purely a documentation update. It adds missing entries to the docs index, updates outdated examples and menu trees, fixes a broken filename reference in a code comment, and corrects factual details (such as supported models and key storage page numbers) to match the current firmware. There are no code behavior changes that would affect security.

AI review queuedcreditby Peter D. Gray · f9b65ce9 · Jun 19, 2026 · 1 fileMessage 0 · OpaqueTriage 0Details
Commit message · Peter D. Gray

credit

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI review queuedDon't restore cached backup password (bkpw) from backup fileby Dmitry Monakhov · 8d71040a · Jun 19, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Dmitry Monakhov

Don't restore cached backup password (bkpw) from backup file

Restore mirrored the write-side strip of bkpw: a crafted backup could inject
setting.bkpw and fixate the password used for future backups. Drop it on restore

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedBump requests from 2.32.4 to 2.33.0 in /testingby dependabot[bot] · 5feae87e · Jun 19, 2026 · 1 fileMessage 86 · StrongTriage 0Details
Commit message · dependabot[bot]

Bump requests from 2.32.4 to 2.33.0 in /testing

Bumps [requests](https://github.com/psf/requests) from 2.32.4 to 2.33.0.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.32.4...v2.33.0)

---
updated-dependencies:
- dependency-name: requests
dependency-version: 2.33.0
dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
Lower-priorityREADME.md update build repro steps (were misordered before)by scgbckbone · 0949c0ac · Jun 19, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · scgbckbone

README.md update build repro steps (were misordered before)

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Security candidatebundle small fixesby scgbckbone · c36eac23 · Jun 19, 2026 · 48 filesMessage 28 · OpaqueModerate 66Details
Commit message · scgbckbone

bundle small fixes

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathauthentication pathparser or protocol path
AI analysis · Moderate 66/100

This is a large bundle of bug fixes for the COLDCARD hardware wallet firmware. Most changes fix user-interface crashes ('yikes'), incorrect error messages, or policy edge cases rather than a single critical vulnerability. The most security-relevant fixes are: (1) disabling NFC and Virtual Disk before entering HSM mode to reduce the attack surface of the locked-down operating mode; (2) preventing a trick/bypass PIN that has no secrets from completing a Single-Signer Spending Policy unlock; (3) stopping OP_RETURN and non-standard scripts from being hidden or mis-displayed during transaction approval; (4) rejecting malformed JSON/QR message-signing requests and control characters that could be used to trick the user; and (5) preventing duplicate multisig wallets with reordered keys from being imported as if they were only a rename. The commit also adds many regression tests for these behaviors.

Lower-priorityfix typo in nfc-pushtx.mdby scgbckbone · a24a894c · May 16, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · scgbckbone

fix typo in nfc-pushtx.md

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount