CommitWatch RSS
FD
← All projectsFoundation

Passport firmware

Firmware for Foundation Passport Bitcoin signing devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

78 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

21security candidates23second-pass queue16AI analyses
3commits · 30 days
7commits · 60 days
66commits · 180 days
78commits · 365 days
Backfill bands
Aug 5 → Feb 612 seen0 candidatesComplete
Feb 6 → Jun 659 seen3 candidatesComplete
Jun 6 → Jul 64 seen0 candidatesComplete
Jul 6 → Aug 52 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

54/100 average clarity
2Strong · 80–100
28Adequate · 60–79
43Thin · 40–59
5Opaque · 0–39
2security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Matt Gleason53139051
Jack744063
Jean-Pierre De Jesus DIAZ822061
Ken Carpenter311048
Jacksper13110058
dependabot[bot]500076
mjg-foundation100045
Analysis record

Published AI watches

Last scanned 22 minutes ago

Moderate 57 AI analysisMessage 55 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Preserve hardened firmware verification result

This bootloader patch changes how the result of a security check on the currently-running firmware is stored. Previously, the code immediately converted the secure verification result into a plain true/false boolean. Now it keeps the speci…

Hardened firmware verification result preservationReplacement of bool with secresult for security-critical return valueBootloader update path depends on firmware validity check
a6efb276by Jack+5−51 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 35 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

Harden firmware update validation

This commit changes how Passport's bootloader checks firmware updates. Previously, if the currently-running firmware failed validation, the bootloader would skip verifying the new update's signature and could install it anyway. Now the new…

Bypassed/missing cryptographic verification path hardenedFirmware update signature check moved to unconditional executionCurrent firmware invalid state no longer skips new firmware signature verification
b157473cby Jack+30−261 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: removed more branching from mnemonic decode process

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, reg…

Branchless, constant-time-style copy of sensitive input wordsMasking of post-delimiter bytes to zero to avoid information leakage via memory access patternsRemoval of conditional stores that depended on word length
d0edb18aby Matt Gleason+13−71 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: refined more comments

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

e58baa89by Matt Gleason+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: improved comments

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

42cad0d8by Matt Gleason+9−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 60 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: responded to more feedback, needs testing and evaluation

This commit hardens the code that converts a user's BIP39 recovery phrase (seed words) into secret bits. It fixes a bug where 8-character words were wrongly rejected, makes the loop length independent of the number of words to reduce timin…

Timing-side-channel mitigation: outer loop iteration count made independent of mnemonic word countOut-of-bounds read prevention: inner loop index bounded against sizeof(padded)-1Off-by-one fix: inner loop bound changed from BIP39_MAX_WORD_LEN-1 to BIP39_MAX_WORD_LEN
42f95ed8by Matt Gleason+25−181 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: made more parts of mnemonic parsing and fetching constant time

This commit hardens the code that converts a user's BIP-39 seed phrase into secret data. It removes timing and loop-behavior clues that an attacker with physical access might measure to learn how many words the phrase has, how long each wo…

Constant-time / secret-independent control-flow hardeningRemoval of input-length-dependent loops in mnemonic parsingRemoval of early returns on invalid word length
5a0cc5edby Matt Gleason+52−183 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 75 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: first pass at anti-sidechannel round 2, needs testing and evaluation

This commit is a defensive hardening change for the BIP-39 seed-word handling code in the Passport hardware wallet firmware. It restructures how the English word list is stored so that a constant-time word comparison function can safely re…

Constant-time/side-channel hardeningFixed-width wordlist storage to avoid out-of-bounds reads in constant-time comparisonRemoval of unreliable wall-clock timing assertions from CI tests
2c7dc29fby Matt Gleason+22−224 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 81 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

Enforce MSG_SIGNING_MAX_LENGTH on microSD message signing

This commit fixes a missing safety limit in the Passport hardware wallet's microSD message-signing feature. Previously, a user could accidentally or maliciously be asked to sign an extremely large file from the microSD card, which could st…

Restores a previously enforced size cap that was removed during code consolidationPrevents oversized message files from being loaded for signing from removable mediaLimits memory pressure and potential crash/DoS surface during message signing
a6dfc59fby Jack+23−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 81 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

Pass expected_address through QR message signing path

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an ex…

Adds expected_address validation to a previously unvalidated code pathMirrors an existing security control from another input path (microSD / PR #636)Separates canonical/raw address used for verification from human-readable stylized address used for display
80fda3a1by Jack+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-3834: fixed return type for quitting message signing

This commit fixes a minor return-value bug in the Passport hardware wallet's health-check flow. When the user cancels message signing, the flow now returns 'None' instead of 'False'. This is a correctness fix that likely prevents a downstr…

Return-type correction in user-cancellation path of signing flowPotential semantic confusion between 'cancelled' and 'failed' health check result
3f29f056by Matt Gleason+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 75 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-3834: added verify step for microsd message signing, fixed export format for sparrow parsing

This firmware update fixes two issues in the Passport hardware wallet's message-signing feature. First, it adds a user confirmation screen when signing a message from a microSD card in normal (non-health-check) mode, so the user can see th…

Missing user confirmation before signing from microSD in normal modeAddress not shown to user prior to signature productionExported signed-message format used mismatched/ambiguous delimiters
18e80883by Matt Gleason+41−22 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: Fix mnemonic_to_bits() and ct_word_eq() to be constant time.

This commit fixes a timing side-channel weakness in the code that converts a BIP-39 recovery phrase (a list of words) back into the secret digital bits. Before the fix, the code stopped searching the word list as soon as it found a match a…

Timing side-channel mitigation in mnemonic decodingConstant-time string comparison added (`ct_word_eq`)Unconditional full wordlist scan to avoid index-dependent timing
f8311ca7by Ken Carpenter+238−183 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-4441: Update Rust dependencies.

This commit updates several Rust library dependencies used in the Passport hardware wallet firmware and makes small code adjustments to match the new library versions. The most notable change is in the cryptographic signing code, where the…

Cryptographic signing API change: removal of Message wrapper in Schnorr signing pathDependency version bumps for security-sensitive crates (secp256k1, bitcoin_hashes)No explicit security advisory, CVE, or vendor security note present in commit or supplied references
efd6bdb3by Jean-Pierre De Jesus DIAZ+16−174 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-3834: added microsd message signing

This commit adds a new menu option that lets users sign a message using a file stored on a microSD card, alongside the existing option to sign by scanning a QR code. It reuses the same internal signing logic that was already used for healt…

No new cryptographic operations introduced; existing sign_text_file_task is reusedNo changes to input validation length checks or address-type handlingFile filter now excludes files containing '-signed' to avoid re-signing output files
e47977e3by Matt Gleason+37−114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-4389: Update copyright e-mail address.

This commit is a bulk update of the company's contact email address in copyright headers and documentation. It replaces 'hello@foundationdevices.com' with 'hello@foundation.xyz' across 728 files. There are no code logic changes, no securit…

8c1f220bby Jean-Pierre De Jesus DIAZ+735−735728 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritySFT-5988: swapped pink and blue, added 5 enter key press to leave keypad testby Matt Gleason · 29709569 · Oct 13, 2025 · 1 fileMessage 75 · AdequateTriage 0Details
Commit message · Matt Gleason

SFT-5988: swapped pink and blue, added 5 enter key press to leave keypad
test

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI review queuedRemove accidentally added fileby Ken Carpenter · bbd9a705 · Oct 13, 2025 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Ken Carpenter

Remove accidentally added file

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
Lower-prioritySFT-5988: Keypad test with multiple colors and press/release visualizationby Ken Carpenter · 3c26157c · Oct 13, 2025 · 2 filesMessage 60 · AdequateTriage 0Details
Commit message · Ken Carpenter

SFT-5988: Keypad test with multiple colors and press/release visualization

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body