CommitWatch RSS
FD
← All projectsFoundation

Passport firmware

Firmware for Foundation Passport Bitcoin signing devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

78 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

21security candidates23second-pass queue13AI analyses
3commits · 30 days
7commits · 60 days
66commits · 180 days
78commits · 365 days
Backfill bands
Aug 5 → Feb 612 seen0 candidatesComplete
Feb 6 → Jun 659 seen3 candidatesComplete
Jun 6 → Jul 64 seen0 candidatesComplete
Jul 6 → Aug 52 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

54/100 average clarity
2Strong · 80–100
28Adequate · 60–79
43Thin · 40–59
5Opaque · 0–39
2security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Matt Gleason53137051
Jack743063
Jean-Pierre De Jesus DIAZ822061
Ken Carpenter311048
Jacksper13110058
dependabot[bot]500076
mjg-foundation100045
Analysis record

Published AI watches

Last scanned 43 minutes ago

Moderate 57 AI analysisMessage 55 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Preserve hardened firmware verification result

This bootloader patch changes how the result of a security check on the currently-running firmware is stored. Previously, the code immediately converted the secure verification result into a plain true/false boolean. Now it keeps the speci…

Hardened firmware verification result preservationReplacement of bool with secresult for security-critical return valueBootloader update path depends on firmware validity check
a6efb276by Jack+5−51 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 35 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

Harden firmware update validation

This commit changes how Passport's bootloader checks firmware updates. Previously, if the currently-running firmware failed validation, the bootloader would skip verifying the new update's signature and could install it anyway. Now the new…

Bypassed/missing cryptographic verification path hardenedFirmware update signature check moved to unconditional executionCurrent firmware invalid state no longer skips new firmware signature verification
b157473cby Jack+30−261 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: removed more branching from mnemonic decode process

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, reg…

Branchless, constant-time-style copy of sensitive input wordsMasking of post-delimiter bytes to zero to avoid information leakage via memory access patternsRemoval of conditional stores that depended on word length
d0edb18aby Matt Gleason+13−71 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: refined more comments

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

e58baa89by Matt Gleason+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: improved comments

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

42cad0d8by Matt Gleason+9−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 60 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: responded to more feedback, needs testing and evaluation

This commit hardens the code that converts a user's BIP39 recovery phrase (seed words) into secret bits. It fixes a bug where 8-character words were wrongly rejected, makes the loop length independent of the number of words to reduce timin…

Timing-side-channel mitigation: outer loop iteration count made independent of mnemonic word countOut-of-bounds read prevention: inner loop index bounded against sizeof(padded)-1Off-by-one fix: inner loop bound changed from BIP39_MAX_WORD_LEN-1 to BIP39_MAX_WORD_LEN
42f95ed8by Matt Gleason+25−181 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: made more parts of mnemonic parsing and fetching constant time

This commit hardens the code that converts a user's BIP-39 seed phrase into secret data. It removes timing and loop-behavior clues that an attacker with physical access might measure to learn how many words the phrase has, how long each wo…

Constant-time / secret-independent control-flow hardeningRemoval of input-length-dependent loops in mnemonic parsingRemoval of early returns on invalid word length
5a0cc5edby Matt Gleason+52−183 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 75 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: first pass at anti-sidechannel round 2, needs testing and evaluation

This commit is a defensive hardening change for the BIP-39 seed-word handling code in the Passport hardware wallet firmware. It restructures how the English word list is stored so that a constant-time word comparison function can safely re…

Constant-time/side-channel hardeningFixed-width wordlist storage to avoid out-of-bounds reads in constant-time comparisonRemoval of unreliable wall-clock timing assertions from CI tests
2c7dc29fby Matt Gleason+22−224 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 81 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

Pass expected_address through QR message signing path

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an ex…

Adds expected_address validation to a previously unvalidated code pathMirrors an existing security control from another input path (microSD / PR #636)Separates canonical/raw address used for verification from human-readable stylized address used for display
80fda3a1by Jack+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: Fix mnemonic_to_bits() and ct_word_eq() to be constant time.

This commit fixes a timing side-channel weakness in the code that converts a BIP-39 recovery phrase (a list of words) back into the secret digital bits. Before the fix, the code stopped searching the word list as soon as it found a match a…

Timing side-channel mitigation in mnemonic decodingConstant-time string comparison added (`ct_word_eq`)Unconditional full wordlist scan to avoid index-dependent timing
f8311ca7by Ken Carpenter+238−183 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-4441: Update Rust dependencies.

This commit updates several Rust library dependencies used in the Passport hardware wallet firmware and makes small code adjustments to match the new library versions. The most notable change is in the cryptographic signing code, where the…

Cryptographic signing API change: removal of Message wrapper in Schnorr signing pathDependency version bumps for security-sensitive crates (secp256k1, bitcoin_hashes)No explicit security advisory, CVE, or vendor security note present in commit or supplied references
efd6bdb3by Jean-Pierre De Jesus DIAZ+16−174 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-4389: Update copyright e-mail address.

This commit is a bulk update of the company's contact email address in copyright headers and documentation. It replaces 'hello@foundationdevices.com' with 'hello@foundation.xyz' across 728 files. There are no code logic changes, no securit…

8c1f220bby Jean-Pierre De Jesus DIAZ+735−735728 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-3834: added microsd message signing

This commit adds a new menu option that lets users sign a message using a file stored on a microSD card, alongside the existing option to sign by scanning a QR code. It reuses the same internal signing logic that was already used for healt…

No new cryptographic operations introduced; existing sign_text_file_task is reusedNo changes to input validation length checks or address-type handlingFile filter now excludes files containing '-signed' to avoid re-signing output files
e47977e3by Matt Gleason+37−114 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedAdd Coconut Wallet single-sig Connect Wallet optionby Jack · 9d60781d · Jun 17, 2026 · 4 filesMessage 73 · AdequateTriage 12Details
Commit message · Jack

Add Coconut Wallet single-sig Connect Wallet option

Add Coconut Wallet (noncelab) to the Connect Wallet flow. It reuses the
generic single-sig JSON export (same payload as Sparrow) over an animated
UR2 QR code: single-sig QR only, no multisig or microSD.

Tag the export with a "model" field set to "passport-core" so Coconut
Wallet can label the imported wallet "Passport Core" (it shows a single
"Passport" connector and names the wallet from this flag). The field is
gated on the wallet config carrying a 'model' key, so all other wallets'
exports are unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-7133: fixed dangerous change check on all taproot inputsby Matt Gleason · 46efe834 · Jun 11, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-7133: fixed dangerous change check on all taproot inputs

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-3834: ensured preview address matches the signed output addressby Matt Gleason · 434d4bcc · May 9, 2026 · 3 filesMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-3834: ensured preview address matches the signed output address

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-3834: removed unused security_menu and sign_text_file_flowby Matt Gleason · d7a7b23d · May 8, 2026 · 4 filesMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-3834: removed unused security_menu and sign_text_file_flow

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-3834: fixed lintby Matt Gleason · 54098dfd · May 6, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Matt Gleason

SFT-3834: fixed lint

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedBump actions/checkout from 4 to 6by dependabot[bot] · df28b1ef · Mar 27, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump actions/checkout from 4 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump actions/upload-artifact from 4 to 7by dependabot[bot] · f5ebe556 · Mar 26, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump actions/upload-artifact from 4 to 7

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump fsfe/reuse-action from 4 to 6by dependabot[bot] · 719da673 · Mar 26, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump fsfe/reuse-action from 4 to 6

Bumps [fsfe/reuse-action](https://github.com/fsfe/reuse-action) from 4 to 6.
- [Release notes](https://github.com/fsfe/reuse-action/releases)
- [Commits](https://github.com/fsfe/reuse-action/compare/v4...v6)

---
updated-dependencies:
- dependency-name: fsfe/reuse-action
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump docker/setup-buildx-action from 3 to 4by dependabot[bot] · a3a2cd05 · Mar 26, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump docker/setup-buildx-action from 3 to 4

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump docker/build-push-action from 6 to 7by dependabot[bot] · 32a32a8a · Mar 26, 2026 · 1 fileMessage 76 · AdequateTriage 0Details
Commit message · dependabot[bot]

Bump docker/build-push-action from 6 to 7

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6...v7)

---
updated-dependencies:
- dependency-name: docker/build-push-action
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
documentation-only discountautomated dependency-update discountsecond-pass: broader security terminology
AI review queuedSFT-5689: improved path mismatch logicby Matt Gleason · b8ff1071 · Mar 26, 2026 · 1 fileMessage 45 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-5689: improved path mismatch logic

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-5689: prevented suspicious change alert for transactions from super-accountsby Matt Gleason · 4c76b7c8 · Mar 25, 2026 · 1 fileMessage 65 · AdequateTriage 12Details
Commit message · Matt Gleason

SFT-5689: prevented suspicious change alert for transactions from
super-accounts

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-6783: fixed check for fully signed transactions with taprootby Matt Gleason · 5ff5e4a3 · Mar 19, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-6783: fixed check for fully signed transactions with taproot

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-6061: fixed lintby Matt Gleason · c4a88714 · Mar 12, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Matt Gleason

SFT-6061: fixed lint

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedSFT-6356: adjusted input already signed messageby Matt Gleason · 6ae0e40b · Mar 2, 2026 · 1 fileMessage 45 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-6356: adjusted input already signed message

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-3235: re-enabled btcpay taprootby Matt Gleason · b7fde52a · Feb 26, 2026 · 1 fileMessage 45 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-3235: re-enabled btcpay taproot

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-6507: removed they singlesigby Matt Gleason · 6ddb59b6 · Feb 26, 2026 · 1 fileMessage 45 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-6507: removed they singlesig

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedENV-2282: fixed taproot versions of component hashes when coming after segwitby Matt Gleason · 939b6a29 · Feb 26, 2026 · 1 fileMessage 65 · AdequateTriage 12Details
Commit message · Matt Gleason

ENV-2282: fixed taproot versions of component hashes when coming after
segwit

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedENV-2282: fixed taproot sighahes after segwit sighashesby Matt Gleason · 959c4fa6 · Feb 26, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

ENV-2282: fixed taproot sighahes after segwit sighashes

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-6061: incomplete nix shellby Matt Gleason · 52f8ada5 · Feb 26, 2026 · 4 filesMessage 45 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-6061: incomplete nix shell

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-6061: nix devshell working, sim commands and flash recipe need workby Matt Gleason · bbfb284c · Feb 26, 2026 · 4 filesMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-6061: nix devshell working, sim commands and flash recipe need work

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSFT-5975: added bull bitcoin export, needs testingby Matt Gleason · fbe6b221 · Nov 26, 2025 · 3 filesMessage 60 · AdequateTriage 12Details
Commit message · Matt Gleason

SFT-5975: added bull bitcoin export, needs testing

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedRemove accidentally added fileby Ken Carpenter · bbd9a705 · Oct 13, 2025 · 1 fileMessage 35 · OpaqueTriage 0Details
Commit message · Ken Carpenter

Remove accidentally added file

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message