CommitWatch RSS
FD
← All projectsFoundation

Passport firmware

Firmware for Foundation Passport Bitcoin signing devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

133 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

43security candidates46second-pass queue123AI analyses
33commits · 30 days
53commits · 60 days
80commits · 180 days
133commits · 365 days
Backfill bands
Aug 5 → Feb 612 seen0 candidatesComplete
Feb 6 → Jun 659 seen3 candidatesComplete
Jun 6 → Jul 64 seen0 candidatesComplete
Jul 6 → Aug 52 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

54/100 average clarity
6Strong · 80–100
38Adequate · 60–79
77Thin · 40–59
12Opaque · 0–39
4security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Matt Gleason651457351
Jacksper1314714367
Jack331731150
Jean-Pierre De Jesus DIAZ828061
mjg-foundation525065
Ken Carpenter313048
dependabot[bot]505076
Analysis record

Published AI watches

Last scanned 41 minutes ago

Informational 24 AI analysisMessage 73 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #665 from Foundation-Devices/casa-crypto-account-export

This commit adds a new feature to Foundation's Passport hardware wallet that exports two cryptographic public keys for Casa wallet registration: the master extended public key and a separate Casa-specific key derived at path m/45'. The key…

New key-export surface: two public keys (master + m/45' derived) are now exported togetherSensitive material is public-key/chain-code only; no private keys are exportedExport channels remain QR and microSD, unchanged from prior Casa export behavior
5e499107by mjg-foundation+291−315 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 73 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #669 from Foundation-Devices/add-native-unchained-connect-wallet

This commit adds support for the Unchained wallet to the Passport hardware wallet. Most of the change is normal feature code, but it also introduces a new way to feed already-encoded data into the QR encoder and tightens up the encoder so …

New unsafe FFI function `ur_encoder_start_raw` added with documented safety preconditionsUR type string is validated (length, charset, UTF-8) before use in encoderEncoder now tracks a `started` flag and returns empty output if not started, reducing use-after-free/misuse risk
26bd36d5by mjg-foundation+426−1812 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 78 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #655 from Foundation-Devices/sft-7320-entropy-hardening

This firmware update hardens the way Passport generates random numbers. Previously, a failing or stuck hardware random-number generator could silently produce weak or repeated values, which is dangerous for creating secret keys. The patch …

Fail-closed RNG error handling: persistent seed/clock errors now trigger a fatal handler instead of returning potentially weak valuesST-recommended seed-error recovery (RM0433 section 34.3.7): clear SEIS and flush 12 discard words, with bounded retry attemptsDuplicate and zero-value rejection in rng_try_sample to avoid returning stuck or invalid RNG output
0f1a5325by mjg-foundation+150−379 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 71 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #675 from Foundation-Devices/fix/verify-change-before-review

This firmware update moves the verification of Bitcoin 'change' addresses to happen before the user reviews the transaction on screen. Previously, the device checked whether change outputs truly belonged to the wallet only after the user h…

Reorders security-critical validation to occur before user approvalValidates change-output ownership before the review screen hides those outputsPrevents transaction signing if change derivation does not match the PSBT
1fea63c8by Jacksper13+174−454 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

SFT-8098: skip change verification for transactions without change

This commit changes how the Passport hardware wallet reviews Bitcoin transactions that have no 'change' output. Previously, the wallet would always run a change-verification step that opens the secure key store, even when there was no chan…

Change reduces unnecessary access to the key store during transaction reviewNo cryptographic check is removed for transactions that actually contain changeUI label changed to more accurately describe the operation being performed
3df93748by Jacksper13+36−112 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

SFT-8098: complete change verification before transaction review

This commit moves a safety check earlier in the process of approving a Bitcoin transaction on the Passport hardware wallet. Previously, the wallet verified that 'change' outputs (money going back to your own wallet) truly belonged to you o…

Change-address verification moved from post-approval signing stage to pre-review stagePSBT change output ownership now proved before user is shown transaction detailsSensitive key derivation context closed before transaction review is displayed
fb88001cby Jacksper13+150−464 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #673 from Foundation-Devices/SFT-7945-add-pytest-to-devshell

This commit is a routine development tooling and cleanup change. It adds the Pytest testing framework to the project's Nix development shell, fixes a test runner path, adds a GitHub Actions workflow to run simulator tests automatically, an…

d8ee1164by mjg-foundation+101−25825 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #648 from Foundation-Devices/dependabot-host-tooling-hygiene

This commit updates the Python Pillow image-processing library used in host-side developer tooling from version 8.x to 12.3.x and requires Python 3.10 or newer. Pillow 8.x is known to have many publicly disclosed security vulnerabilities, …

Dependency version bump of a library with known historical vulnerabilities (Pillow 8.x)Constraint now requires Python 3.10+ alongside the newer Pillow major versionChange is limited to host tooling files (pyproject.toml, setup.py, requirements-optional.txt, tox.ini, DEVELOPMENT.md)
d6c05830by Jacksper13+6−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #649 from Foundation-Devices/bitcoin-safe-wallet-flow

This commit adds support for a new Bitcoin software wallet called 'Bitcoin Safe' to the Passport hardware wallet firmware. It is a straightforward feature addition that registers the wallet in the firmware's list of supported software wall…

9f1e36b0by Jacksper13+27−03 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #653 from Foundation-Devices/show-op-return-output-amount

This update changes how the Passport hardware wallet displays Bitcoin transaction outputs that carry data (OP_RETURN outputs). Previously, only the embedded message was shown. Now the device also shows the amount of bitcoin assigned to tha…

UI spoofing hardening: user-controlled OP_RETURN data is now escaped before renderingNew display of OP_RETURN output amount reduces risk of hidden value leakageUnit test includes an attacker-controlled message simulating fake Amount/Destination headings
433c4a20by Jacksper13+79−33 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 78 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #660 from Foundation-Devices/fix/legacy-settings-overflow

This commit fixes a bug in how the Passport hardware wallet saves its settings to internal flash memory. Previously, the code checked whether the settings data was too large only after it had already picked and erased a flash storage slot.…

Buffer size validation moved before flash write/erase operationsReplaced broken 'assert false' crash path with explicit ValueErrorAdded unit test for oversized settings rejection
180e183dby Jacksper13+34−113 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 78 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

tooling: constrain tox Pillow dependency (SFT-7281)

This commit tightens a software dependency used only in testing/development tooling. It prevents an automated test environment from installing old, known-vulnerable versions of the Pillow image library when running under Python 3.10. The c…

Dependency constraint added to block known-vulnerable Pillow versionsCommit message acknowledges prior path could install an older vulnerable releaseChange is in Trezor external module tooling, not Passport firmware runtime
56799183by Jack+2−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 73 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #662 from Foundation-Devices/fix/unverified-psbt-fees

This firmware update fixes a security issue in the Passport hardware wallet's handling of Bitcoin transaction fees. Previously, when a transaction file (PSBT) only provided a claimed input amount without the full previous transaction to pr…

UI now displays 'Unverified' instead of a numeric network fee when input amounts cannot be independently verifiedNew assertion prevents witness/non-witness UTXO value or scriptPubKey mismatch for the same inputHistory-cache amount updates are deferred until after cryptographic proof of input ownership is completed
7b64e920by Jacksper13+336−627 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #661 from Foundation-Devices/fix/seedqr-validation

This update tightens the checks on SeedQR codes, which are QR codes that encode a wallet's backup seed phrase as numbers. Before, the decoder might accept invalid or oddly-sized numeric strings and either crash or produce an incorrect seed…

Input validation added to seed-import pathOut-of-range BIP-39 word index now rejected explicitlyNon-digit characters rejected before integer conversion
2c41d1c5by Jacksper13+59−63 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 28 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

fixed excess delete call

This tiny change removes two variables ('pu' and 'skp') from a Python 'del' cleanup statement in the code that signs Bitcoin transactions. The commit message says it fixes an 'excess delete call.' In Python, deleting a name that does not e…

Change is in a sensitive operation: PSBT signingOriginal code could raise NameError and crash the signing taskNo explicit security claim in commit message or diff
1b2efc8fby Matt Gleason+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

fixed format

This commit adds a single blank line between two test functions to fix code formatting. It makes no functional changes to the firmware or its tests.

52ade0a1by Matt Gleason+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #672 from Foundation-Devices/fix/validate-local-multisig-xpub

This update fixes a validation gap when importing multisig wallets into the Passport hardware wallet. Previously, the device only checked that the public key matched; now it also checks the chain code. Without this check, a tampered extend…

Incomplete cryptographic input validation (public key only, not full xpub)Potential acceptance of tampered extended public keys in multisig wallet importFix adds chain_code equality check alongside existing public_key equality check
b1756906by Jacksper13+95−24 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-7945: test suite working in devshell, removed unused translation

This commit is a routine cleanup and test-infrastructure change. It removes an unused translation system (translation files, imports, and a test), updates linting rules to no longer exclude the now-removed translation folder, and fixes the…

d8353514by Matt Gleason+25−21420 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Integrate PSBT fee and amount validation

This commit adds a test fixture flag called witness_utxo to a fake PSBT input object used in unit tests, and documents a changelog entry about marking network fees as 'unverified' when a PSBT input's UTXO data cannot be verified. The actua…

PSBT fee/amount validationunverifiable inputs flagged as unverifiedwitness UTXO handling
409137c9by Jack+2−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Reuse sensitive values during PSBT validation

This firmware update changes how Passport validates Bitcoin transaction files (PSBTs) before signing. It makes two main improvements: it reuses the wallet's secret seed for fewer key-derivation operations, and it verifies that the claimed …

Deferred and batched sensitive key derivation during PSBT validationAmount-cache update moved after ownership/key-path proofNew assertion to block re-signing already-signed non-multisig inputs
f88420bfby Jack+72−213 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedSFT-5975: added bull bitcoin export, needs testingby Matt Gleason · fbe6b221 · Nov 26, 2025 · 3 filesMessage 60 · AdequateInformational 15Details
Commit message · Matt Gleason

SFT-5975: added bull bitcoin export, needs testing

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds support for exporting wallet data to a new software wallet called Bull Bitcoin. It is a straightforward feature addition with no visible security-relevant changes. There is no indication of a vulnerability, bug fix, or security patch.

Lower-priorityUpdate version.txt to v2.3.10by mjg-foundation · bef569ce · Oct 22, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · mjg-foundation

Update version.txt to v2.3.10

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only changes a version number in a text file from 2.3.9 to 2.3.10. There is no code change, no security fix, and no functional change visible in the diff.

Lower-prioritySFT-5988: bumped debounce timeby Matt Gleason · e443ec84 · Oct 16, 2025 · 1 fileMessage 45 · ThinInformational 11Details
Commit message · Matt Gleason

SFT-5988: bumped debounce time

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 11/100

This commit increases the keypad debounce time from 20 to 120 time units. Debouncing is a normal hardware/software fix to prevent a single physical button press from being registered multiple times. The change is very small and routine, with no direct evidence of a security vulnerability.

Lower-prioritySFT-5988: adjusted keypad test layout to fit new countersby Matt Gleason · 68973ddc · Oct 14, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Matt Gleason

SFT-5988: adjusted keypad test layout to fit new counters

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit simply rearranges the on-screen keypad layout in a hardware wallet test screen so that new counter elements fit. It changes spacing, widths, and positions of on-screen buttons. There is no security relevance.

Lower-prioritySFT-5988: added counters to keypad displayby Matt Gleason · a7d489f4 · Oct 14, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Matt Gleason

SFT-5988: added counters to keypad display

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit changes the on-screen keypad display to show a small counter next to each key label, tracking how many times the key has been released. It is a UI/debugging enhancement with no apparent security relevance.

Lower-prioritySFT-5988: swapped pink and blue, added 5 enter key press to leave keypad testby Matt Gleason · 29709569 · Oct 13, 2025 · 1 fileMessage 75 · AdequateInformational 15Details
Commit message · Matt Gleason

SFT-5988: swapped pink and blue, added 5 enter key press to leave keypad
test

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit changes the colors used in a factory-style keypad test screen and adds a new way to exit the test by pressing the Enter key five times. There is no security-relevant change visible in the diff.

AI review queuedRemove accidentally added fileby Ken Carpenter · bbd9a705 · Oct 13, 2025 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Ken Carpenter

Remove accidentally added file

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit simply deletes a README file that described a factory testing feature. No code, firmware, or security controls were changed. The file itself was documentation and appears to have been added by mistake. There is no direct security impact from removing it.

Lower-prioritySFT-5988: Keypad test with multiple colors and press/release visualizationby Ken Carpenter · 3c26157c · Oct 13, 2025 · 2 filesMessage 60 · AdequateInformational 15Details
Commit message · Ken Carpenter

SFT-5988: Keypad test with multiple colors and press/release visualization

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds documentation for a factory test mode and improves the on-screen keypad test so it shows different colors when keys are pressed and released. It is a routine manufacturing/quality-assurance change with no security relevance.