CommitWatch RSS
KX
← All projectsKrux

Krux

Open-source signing firmware for Kendryte K210 devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

223 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

58security candidates41second-pass queue216AI analyses
5commits · 30 days
41commits · 60 days
97commits · 180 days
200commits · 365 days
Backfill bands
Aug 5 → Feb 6116 seen6 candidatesComplete
Feb 6 → Jun 639 seen3 candidatesComplete
Jun 6 → Jul 622 seen1 candidatesComplete
Jul 6 → Aug 538 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

65/100 average clarity
60Strong · 80–100
66Adequate · 60–79
81Thin · 40–59
16Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Odudex291429272
odudex902989159
Tads361036063
qlrd18216082
kdmukai424066
tadeubas414038
kkdao12012083
Jean Do1006072
Naman015505060
bitcoisas505066
Naman Gupta202079
SatsCzar202062
Analysis record

Published AI watches

Last scanned 41 minutes ago

Moderate 66 AI analysisMessage 45 · Thin
KX KruxKrux BitcoinHardware wallets

Merge branch 'release-26.08.0'

This is a routine release merge for Krux firmware (version 26.08.0). It includes several genuine security fixes: a heap buffer overflow in camera-based entropy generation for a discontinued device, stricter fee calculation when signing Bit…

Heap buffer overflow fix in camera entropy module (discontinued Maix Bit only)PSBT fee calculation stricter checks and unverified-input-amount warningStored mnemonic file corruption now preserved instead of overwritten
be5eda28by odudex+4335−3028123 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
KX KruxKrux BitcoinHardware wallets

docs: update CHANGELOG

This commit only updates three date lines in the CHANGELOG.md file, changing '2025' to '2026' for three release entries. It does not modify any source code, build scripts, or documentation with security implications. The change is purely c…

ec058d86by odudex+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: bind BBQr parts to the first part of the stream

This commit fixes Krux's QR code scanner so that when it reads a series of animated BBQr codes, every later frame must match the encoding and file type announced by the first frame, must agree on the total number of frames, and cannot over…

Input validation added for multi-part BBQr streamsMemory exhaustion mitigation via accumulated payload capAnti-splicing: parts must agree with first part's encoding and file type
0b3e01b7by odudex+86−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
KX KruxKrux BitcoinHardware wallets

docs: update CHANGELOG

This commit only updates the project's CHANGELOG.md file. It adds text describing several bug fixes and improvements that were apparently made in prior code changes, but no actual code is changed in this commit. By itself, this documentati…

4c05cefbby odudex+9−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 40 · Thin
KX KruxKrux BitcoinHardware wallets

chore(Maixpy): bump cUR

This commit appears to be a routine version bump of a component called 'cUR' inside the MaixPy firmware build. No actual code changes are visible in the provided diff, and the commit message gives no indication of a security fix or vulnera…

74d6ed40by odudex+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
KX KruxKrux BitcoinHardware wallets

chore: bump version to 26.08.0

This commit is a routine version bump from 26.04.0 to 26.08.0. It only updates version strings in documentation, build files, and source metadata. No code behavior changes. The changelog text mentions a previously fixed heap buffer overflo…

Changelog references a prior heap buffer overflow in Shannon entropy module (camera frame copy into fixed 320x240 RGB565 buffer)No actual code or security fix present in this commit
dea991dfby odudex+5−55 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 2 AI analysisMessage 57 · Thin
KX KruxKrux BitcoinHardware wallets

chore: bump MaixPy with updated glyphs

This commit appears to update a submodule or dependency called MaixPy to a newer version that includes updated visual glyphs (small icons/symbols). The title and message describe it as a routine maintenance chore, not a security fix. No ac…

a9329228by odudex+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: register embed_fire in the bdftokff device list

This commit fixes a build-time font-generation script so that a newly supported device ('embed_fire') is recognized. Before the fix, the script printed an error but still produced the same font files. There is no security issue.

f15308e4by odudex+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 57 · Thin
KX KruxKrux BitcoinHardware wallets

docs: add PSBT input amount fixes to CHANGELOG

This commit only updates the project's CHANGELOG.md to document earlier fixes related to PSBT (Partially Signed Bitcoin Transaction) fee and amount handling. It does not contain any code changes itself. The changelog entries describe secur…

Changelog documents prior PSBT fee/amount validation fixesMentions insufficient coordinator data as a security concernNo actual code or test changes in this commit
48920c31by odudex+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 78 AI analysisMessage 95 · Strong
KX KruxKrux BitcoinHardware wallets

fix: verify PSBT input amounts before showing the fee

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify …

Fixes fee-display/sighash amount mismatchAdds prevout txid hash verification for non_witness_utxoMandates non_witness_utxo for legacy inputs
fc808059by odudex+353−122 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: reject a PSBT whose outputs exceed its inputs

This commit fixes a bug in Krux, a Bitcoin signing device, where a malformed transaction whose outputs spend more than its inputs could be loaded and shown to the user. Normally such a transaction is impossible on the Bitcoin network, but …

Input validation gap in PSBT parsingUI rendering bug masking invalid transaction economicsPotential social-engineering / user-confusion attack
d6813d88by odudex+52−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
KX KruxKrux BitcoinHardware wallets

i18n: translate the unverified input amounts warning

This commit only adds translations for two existing warning messages in the Krux Bitcoin hardware wallet software. It does not change any code logic, security behavior, or fix any vulnerability. The messages warn users that displayed fees …

bdaed1a1by odudex+46−023 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

feat: warn when PSBT input amounts cannot be verified

This commit adds a warning screen to Krux, a hardware signing device, when it is asked to sign a multi-input Bitcoin transaction where the amounts of some inputs cannot be independently verified. The risk is that a malicious transaction co…

New user-facing warning for unverified multi-input SegWit amountsDetection logic tied to BIP143 signature semantics and inp.is_verifiedDoes not enforce previous-transaction inclusion; user can still proceed
518b3314by odudex+159−24 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: render negative amounts correctly in format_btc

This commit fixes a display bug in how Krux formats negative Bitcoin amounts. Previously, a value like -1000 satoshis was shown incorrectly as roughly -1.99 bitcoins instead of -0.00001 bitcoins, because the code split the number before ha…

UI/display bug in financial amount renderingNo cryptographic, authorization, or memory-safety changesNo input validation, parsing, or serialization of untrusted data changed
c7e48ae1by odudex+22−12 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 53 AI analysisMessage 62 · Adequate
KX KruxKrux BitcoinHardware wallets

docs: add Maix Bit removal and Shannon calc fix to CHANGELOG

This commit is a documentation update to the project's changelog. It describes two security-related changes that were apparently made in earlier code: a heap buffer overflow in the camera-based entropy (randomness) module that could only b…

Heap buffer overflow in camera entropy / Shannon entropy moduleOut-of-bounds write of 49,152 bytes on discontinued Maix Bit deviceRemoval of deterministic os.urandom() PRNG from firmware
b0a7357eby odudex+7−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 82 · Strong
KX KruxKrux BitcoinHardware wallets

chore: bump MaixPy with Shannon changes and RNG removal

This commit updates a bundled firmware component called MaixPy. The commit message says it fixes a 'Shannon heap overflow,' removes an unused random-number binding, and drops support for one hardware variant (Maix Bit). A heap overflow is …

Commit message explicitly mentions fixing a heap overflowRemoval of an unused cryptographic/randomness binding (os.urandom)Submodule bump only; no source-level patch visible in this commit
5c4ece9aby odudex+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 52 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: remove Maix Bit and CIF camera support

This commit removes support for an old, discontinued hardware device called the Maix Bit from the Krux Bitcoin wallet firmware. The commit message says the Maix Bit's camera resolution (CIF) was the only one that fed frames larger than QVG…

Buffer overflow / scratch buffer overflow claimed in commit message (49,152 bytes)Removal of vulnerable hardware code path rather than hardening the entropy moduleDiscontinuation of affected device reduces real-world exposure
8090ac73by odudex+11−1279 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

refactor: use native uUR on tests and simulator

This commit is a routine engineering cleanup: it removes a Python-only compatibility layer (a 'shim') used for testing and simulation, and makes the test environment use the same C-language UR encoder/decoder module that the real hardware …

2fe2f5f5by odudex+108−24919 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 62 · Adequate
KX KruxKrux BitcoinHardware wallets

refactor: catch Exception, not bare except, in parse_wallet fallbacks

This commit tightens error handling in Krux's wallet parsing. Previously, the code used bare 'except:' clauses that would catch everything, including KeyboardInterrupt and SystemExit. Those special exceptions should normally be allowed to …

Bare except clauses replaced with except Exception to avoid swallowing KeyboardInterrupt/SystemExitNew regression test ensures KeyboardInterrupt propagates through all parse_wallet fallback branchesComments explicitly call out untrusted input and interrupt propagation behavior
6f617710by kkdao+42−72 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateEmbed Fire - update krux build scriptby odudex · e6b895e5 · Oct 30, 2025 · 2 filesMessage 45 · ThinInformational 15Details
Commit message · odudex

Embed Fire - update krux build script

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit simply adds a new hardware device called 'Embed Fire' to the list of devices Krux builds firmware for during release builds. It is a build-script update with no visible security implications.

Security candidateEmbed Fire - update Maixpyby odudex · 9eb4ebe3 · Oct 30, 2025 · 4 filesMessage 35 · OpaqueInformational 15Details
Commit message · odudex

Embed Fire - update Maixpy

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a routine version bump from 25.10.1 to 25.11.beta0 in three files: documentation config, Python package config, and source metadata. The actual firmware submodule 'firmware/MaixPy' is referenced as changed but its diff is not shown. There is no visible security-relevant code change in the supplied diff.

Security candidateNew Device: Embed Fire (#738)by Odudex · dd36f474 · Oct 30, 2025 · 31 filesMessage 86 · StrongInformational 15Details
Commit message · Odudex

New Device: Embed Fire (#738)

* add new device: Embed Fire

custom display initialization for Embed Fire

* add touchscreen tests
not only for Embed Fire

* Embed Fire added to simulator and docs (#53)

---------

Co-authored-by: Tads <tadeubas@gmail.com>

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit adds support for a new hardware device called 'Embed Fire' to the Krux Bitcoin signer firmware. It includes new display and touchscreen driver code, build/flash tooling updates, simulator support, documentation, and a large set of unit tests. There is no indication in the commit or supplied references that this change fixes or introduces a security vulnerability.

Security candidateRelease 25.10.1 (#757)by Odudex · 64212093 · Oct 30, 2025 · 10 filesMessage 74 · AdequateModerate 64Details
Commit message · Odudex

Release 25.10.1 (#757)

* BugFix: Passphrase (via encrypted mnemonic entropy) fails gracefully (#756)

* resolve bug found by @tadeubas around encrypted passphrases
In Cpython a UnicodeDecodeError was being caught/ignored by the ValueError,
while in MaixPy, a TypeError was being raised, not caught, bubbling up:
...whenever an encrypted passphrase returned bytes that could not be decoded to a string.
Symptoms:
on simulator: appeared as if NOT KEF or user declines to decrypt,
on k210: TypeError("Can't convert 'int' object to str implicitely",)

* Passphrases: Ensure they are ASCII strings

* better error handling for decrypted wallet descriptors

* Similar pattern fix for encrypted addresses that don't decode
decoding of plaintext data is done separately in it's on
try except block to catch decoding errors and fail early.

---------

Co-authored-by: odudex <odudex@proton.me>

* update version: 25.10.1

---------

Co-authored-by: Jean Do <117163651+jdlcdl@users.noreply.github.com>

74/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
entropy or randomnessaccess controlsigning or wallet path
AI analysis · Moderate 64/100

This release fixes a bug in Krux, a Bitcoin signing device firmware. When a user scanned an encrypted QR code meant to provide a wallet passphrase, address, or wallet descriptor, the device could silently treat the raw encrypted bytes as the passphrase/data instead of showing an error. That could lead to the wrong Bitcoin wallet being derived, with no warning to the user. The patch adds proper error handling and now rejects non-ASCII passphrases.

AI review queueddocs: adjust deviced images adjust BULL coordinator labels and linksby odudex · 05bbb0c0 · Oct 28, 2025 · 3 filesMessage 77 · AdequateInformational 15Details
Commit message · odudex

docs: adjust deviced images
adjust BULL coordinator labels and links

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates documentation. It renames a wallet coordinator from 'Bull Bitcoin' to 'BULL Wallet' with a new link, and adds CSS margin styling to device images on the project homepage. There are no code or firmware changes, and no security implications.

AI review queueddocs: adjust deviced images adjust BULL coordinator labels and linksby odudex · 10a12c35 · Oct 28, 2025 · 3 filesMessage 77 · AdequateInformational 15Details
Commit message · odudex

docs: adjust deviced images
adjust BULL coordinator labels and links

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates documentation. It renames a wallet coordinator from 'Bull Bitcoin' to 'BULL Wallet' with a new link, and adds small margin styling to device images on the project homepage. There are no code or security changes.

Lower-priorityre-add WonderK to changelog add missing minor changes from previous changelogby odudex · 142fd283 · Oct 27, 2025 · 1 fileMessage 65 · AdequateInformational 15Details
Commit message · odudex

re-add WonderK to changelog
add missing minor changes from previous changelog

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only edits the project's CHANGELOG.md file. It adds a new changelog section for an upcoming release, re-adds credit for a new device called WonderK PRO, and lists several minor changes that were omitted from a previous changelog update. There are no code changes, no bug fixes, and no security-related content in the diff.

Lower-priorityadd TZT to action build IIby odudex · cae75bba · Oct 27, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · odudex

add TZT to action build II

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit is a routine GitHub Actions workflow change. It removes the automated build step for one hardware device (the 'Bit') and adds an equivalent build step for a different hardware device (the 'TZT'). There is no indication of a security fix, vulnerability, or malicious change.

Lower-priorityadd TZT to action build IIby odudex · 592db5fb · Oct 27, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · odudex

add TZT to action build II

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit simply swaps one hardware device target in the project's automated build script. It removes build steps for the 'Bit' device and adds equivalent build steps for a new 'TZT' device. There is no change to the actual Krux software code, no security fix, and no vulnerability introduced.

AI review queuedadd TZT to and remove bit from action build and release scriptby odudex · fadf12c9 · Oct 27, 2025 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · odudex

add TZT to and remove bit from action build and release script

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply updates the list of supported hardware devices in the project's automated build system and release-signing script. It removes one device ('bit') and adds another ('tzt'). There is no code change that affects security, cryptography, or user-facing behavior.

AI review queuedadd TZT to and remove bit from action build and release scriptby odudex · 7d792495 · Oct 27, 2025 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · odudex

add TZT to and remove bit from action build and release script

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply updates the list of supported hardware devices in the project's automated build script and release-signing script. It removes one device ('bit') and adds another ('tzt'). There is no security-relevant change in the code itself.

Lower-priorityFrench translation adjust by Jeanne and Jean Doby odudex · 3006727c · Oct 27, 2025 · 2 filesMessage 45 · ThinInformational 15Details
Commit message · odudex

French translation adjust by Jeanne and Jean Do

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
translation-only discount
AI analysis · Informational 15/100

This commit is a minor update to the French translation of one user-facing message. It rewords a sentence about automatic reboot behavior after a display setting change. There is no code logic change and no security relevance.

Lower-priorityFrench translation adjust by Jeanne and Jean Doby odudex · 72a46651 · Oct 27, 2025 · 2 filesMessage 45 · ThinInformational 15Details
Commit message · odudex

French translation adjust by Jeanne and Jean Do

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
translation-only discount
AI analysis · Informational 15/100

This commit is a minor update to the French translation of a single user-facing message. It rewords a sentence that tells users the device will automatically reboot if the display stops working after a settings change. There is no code logic change and no security relevance.

Lower-priorityUpdate docs with note about improved SD card compatibilityby tadeubas · 9b8774a6 · Oct 26, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · tadeubas

Update docs with note about improved SD card compatibility

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates user-facing documentation. It adds a note that a newer Krux version improved microSD card compatibility and fixes a help-link path. There are no code changes and nothing that affects security.

AI review queuedadd bull bitcoin to docsby tadeubas · 0b3f38eb · Oct 25, 2025 · 2 filesMessage 38 · OpaqueInformational 15Details
Commit message · tadeubas

add bull bitcoin to docs

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates user documentation to add Bull Bitcoin as a compatible wallet coordinator and makes a minor punctuation edit. There are no code changes and no security implications.

Lower-priorityFix mnemonic printing issue with long words (#751)by Tads · 47d3eb21 · Oct 25, 2025 · 7 filesMessage 73 · AdequateInformational 19Details
Commit message · Tads

Fix mnemonic printing issue with long words (#751)

* Fix mnemonic printing issue with long words

* fix device error when displaying backup as word numbers

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 19/100

This commit fixes how Krux prints a wallet's backup words to a small thermal printer. Previously, long BIP39 words could run into the next column and make the printed backup hard or impossible to read correctly. The change also switches word-only backups from three columns to two columns and uses a fixed 12-character column width, so longer words no longer overlap. It also fixes a related device error when showing backups as word numbers. There is no evidence this is a remotely exploitable security flaw; it is a reliability/usability fix for physical backups.

Lower-priorityFix mnemonic printing issue with long words (#751)by Tads · ae240f04 · Oct 25, 2025 · 7 filesMessage 73 · AdequateInformational 18Details
Commit message · Tads

Fix mnemonic printing issue with long words (#751)

* Fix mnemonic printing issue with long words

* fix device error when displaying backup as word numbers

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
AI analysis · Informational 18/100

This commit fixes a layout bug in Krux, a Bitcoin hardware-wallet tool, that affected how mnemonic (seed phrase) words and their numeric equivalents are printed on thermal paper. Long words could previously wrap or collide with adjacent columns, making a paper backup harder to read or potentially ambiguous. The fix changes the print format from three narrow columns to two wider columns for word backups, and keeps three fixed-width columns for decimal/hex/octal number backups. It also moves some internal label constants to a shared location and corrects a device error when showing backups as word numbers. There is no evidence in the commit of a security vulnerability such as secret leakage or remote code execution.

AI review queuedupdate versionby odudex · 9214d5ec · Oct 24, 2025 · 3 filesMessage 18 · OpaqueInformational 15Details
Commit message · odudex

update version

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit simply changes three version strings from a beta release name (25.10.beta3) to the final release name (25.10.0). It does not modify any code that handles data, cryptography, user input, or device behavior. There is no security-relevant change.

Security candidateupdate Maixpy fontsby odudex · f9e1f7d5 · Oct 24, 2025 · 1 fileMessage 28 · OpaqueInformational 3Details
Commit message · odudex

update Maixpy fonts

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
boot or update path
AI analysis · Informational 3/100

This commit is described as updating fonts in the MaixPy firmware component. No actual code diff is available, and there are no verified references linking this change to any security issue. Based solely on the provided materials, there is no evidence this is a security fix or introduces a vulnerability.

Security candidateupdate Maixpy fontsby odudex · fb9cc51f · Oct 24, 2025 · 1 fileMessage 28 · OpaqueInformational 2Details
Commit message · odudex

update Maixpy fonts

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
boot or update path
AI analysis · Informational 2/100

This commit is described as updating fonts in the MaixPy firmware component. No actual code diff is available, and there are no verified references linking the change to any security issue. Based solely on the provided materials, there is no evidence this is a security fix or introduces a vulnerability.

AI review queuedupdate changelogby odudex · 24ae72fd · Oct 24, 2025 · 1 fileMessage 18 · OpaqueInformational 15Details
Commit message · odudex

update changelog

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only edits the project's changelog text. It reorders and rewords release notes, updates the version/date heading, and fixes minor punctuation. No code, firmware, cryptographic logic, or security behavior was changed.

AI review queuedup version to beta3by odudex · 03374b23 · Oct 24, 2025 · 3 filesMessage 28 · OpaqueInformational 15Details
Commit message · odudex

up version to beta3

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only bumps the project's version label from '25.10.beta2' to '25.10.beta3' in three files. It contains no code, configuration, or behavior changes that affect security.

AI review queuedFix and update device docs, datum sequence, and images (#748)by Tads · 4de2cac1 · Oct 24, 2025 · 26 filesMessage 83 · StrongInformational 15Details
Commit message · Tads

Fix and update device docs, datum sequence, and images (#748)

* fix docs datum + imgs

* Add tools > touchscreen description in docs

* added more coverage

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: unusually broad change
AI analysis · Informational 15/100

This commit is a routine maintenance patch: it moves the 'Check SD Card' feature from the Tools menu into the Device Tests menu, updates user documentation and screenshots, refreshes simulator button sequences, and adds unit tests. There is no security-relevant code change and no indication of a vulnerability being fixed.

Lower-priorityXOR pt-BR adjust update beta versionby odudex · 00a292f4 · Oct 22, 2025 · 5 filesMessage 45 · ThinInformational 15Details
Commit message · odudex

XOR pt-BR adjust
update beta version

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a routine version bump and a minor grammar fix in Portuguese translations. It changes one sentence in the Brazilian Portuguese user interface text so it reads more naturally, and updates the firmware version label from beta1 to beta2 across project files. There is no security-relevant code change.

Security candidateXOR doesn’t display invalid mnemonic lengths for user selection (#747)by Tads · bfbdaec5 · Oct 22, 2025 · 32 filesMessage 81 · StrongInformational 24Details
Commit message · Tads

XOR doesn’t display invalid mnemonic lengths for user selection (#747)

* XOR doesn’t display invalid mnemonic lengths for user selection

* XOR prompt msg now warns about passphrase

* XOR fix incorrect fingerprint displayed when using passphrase

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
access control
AI analysis · Informational 24/100

This commit fixes two user-facing bugs in Krux's 'mnemonic XOR' feature. First, when asking the user to pick a mnemonic length, it now only shows the length that matches the currently loaded wallet (12 or 24 words), preventing the user from accidentally selecting an incompatible length. Second, it now warns the user that the wallet passphrase and descriptor will be discarded before starting the XOR operation, and it corrects the fingerprint shown after the XOR so it no longer incorrectly includes the old passphrase. These are usability and correctness fixes rather than remote-exploitable security holes.