Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit fixes a small but meaningful bug in the Ledger Bitcoin app's code that handles advanced multi-signature (MuSig) operations. A function called crypto_tr_lift_x can fail when given an invalid x-coordinate that does not correspond…
Unchecked return value from cryptographic point-lifting functionPotential use of invalid/uninitialized curve point in MuSig signing flowMissing error propagation in compressed public-key parsing
This commit hardens a Bitcoin transaction parser in Ledger's app. It changes some numeric fields to safer types, adds bounds checks on transaction counts and sizes, rejects extra trailing bytes after a transaction, checks a previously-igno…
Integer type narrowing and sentinel change from -1 to SIZE_MAXBounds checks before uint64_t to unsigned int castsReturn value of parser_consolidate_buffers now checked
This commit changes what information the Ledger Bitcoin app shows on its screen when signing a transaction that includes 'external inputs'—coins the user did not provide and whose amounts the device cannot independently verify. Previously …
UI/UX hardening: additional contextual data shown for transactions with unverified external inputsNo change to cryptographic checks, sighash validation, or input verificationExternal inputs warning is preserved; new data is displayed only when the input set is closed (no ANYONECANPAY)
This commit only updates test screenshot snapshots for the Ledger Bitcoin app. It does not change any application source code, so it cannot directly fix or introduce a security vulnerability in the shipped app. The snapshots reflect new ex…
No source-code changes in the commitOnly test snapshot images (PNG) are modified or addedCommit title references trustworthy amount/fee display for non-default sighash, suggesting a prior functional change exists elsewhere
This commit only adds and updates automated integration tests for the Ledger Bitcoin app. It does not change the app's actual signing code. The tests verify that the device now shows clearer, more trustworthy on-screen amount and fee infor…
No C/device firmware code changesTest-only commit adjusting UI navigation expectationsNew tests assert that negative fees are rejected for default sighash but allowed/relabeled for ANYONECANPAY sighash
This commit only adds new automated unit tests for functions that decide how transaction amounts and fees are displayed on a Ledger device when signing a Bitcoin transaction with non-standard signature hash (sighash) modes. It does not cha…
Commit title references trustworthy amount/fee display for non-default sighash, a historically sensitive area in hardware-wallet signing UITests cover sighash commitment semantics (SIGHASH_NONE, SIGHASH_SINGLE, SIGHASH_ANYONECANPAY combinations) that directly affect what outputs a signature commits toNo functional code changes in this commit; only unit-test additions
This commit changes how the Ledger Bitcoin app shows transaction amounts and fees on the device screen when a user signs a transaction that does not use the normal 'sign everything' rule (a so-called non-default sighash). Previously the ap…
This commit is a small code cleanup in the Ledger Bitcoin app. It removes an initial loop that counted commands and instead checks for the end marker directly while processing. The author says the old loop was unnecessary and caused a harm…
Commit message explicitly frames the change as removing a redundant scan and a static-analysis false positive, not as a security fix.No change to parsing, cryptography, authorization, or transaction semantics.Functional behavior for valid command lists is equivalent before and after the patch.
This commit only fixes a documentation/declaration inconsistency in a C header file. The function parameter name in the comment is changed from `in_len` to `inlen` to match the actual declaration, and the output pointer is annotated with a…
This commit adds test-only helper code for creating Bitcoin transaction fixtures that support newer wallet types (MuSig2 multi-signature and several legacy/wrapped SegWit descriptor forms). It is not a change to the Ledger app firmware its…
No security-relevant signal: change is in test utilities onlyAdds cryptographic helper for MuSig2 key aggregation in test fixturesAdds P2SH/P2SH-P2WPKH/P2SH-P2WSH script generation in test fixtures
This commit is purely a build-system and test-harness cleanup. It refactors CMakeLists.txt, updates comments, simplifies the speculos test bridge, and removes a workaround in a test file. Nothing here changes the actual Ledger Bitcoin app …
This commit only adds new unit tests and renames some existing test functions. It does not change any production code behavior, so it cannot introduce a security vulnerability or fix one on its own.
This commit only adds unit tests and a test-only bridge implementation for cryptographic signing functions. It does not change the actual device application code that users rely on, so it cannot introduce a security vulnerability in the sh…
This commit is a test-only refactoring: it removes a set of local mock SDK headers and a software SHA-256 implementation used by unit tests, and instead makes those tests run against the real Ledger SDK headers through the existing Speculo…
No production code changesTest infrastructure refactoring onlyRemoval of local cryptographic mock in favor of real SDK/speculos bridge
This commit is purely about improving the project's automated test setup. It links unit tests to a software simulator (Speculos) so cryptographic code can be tested on a regular computer without a physical Ledger device. It adds tests for …
This commit is purely a testing infrastructure cleanup. It removes a workaround called SKIP_FOR_CMOCKA that previously hid parts of the code from unit tests, and instead compiles those parts using a more realistic emulator bridge (speculos…
This commit only adds unit tests and test-support code. It does not change the actual Bitcoin app that runs on Ledger devices, so it cannot introduce a security vulnerability in shipped firmware. The changes make the test harness able to s…
This commit only adds helper functions for unit tests to convert Bitcoin extended public keys (xpubs) between base58 string form and raw binary form. It does not change the actual Ledger app code that runs on the device, nor does it fix or…
This commit only adds unit tests and test infrastructure for Bitcoin Taproot cryptographic helpers. It does not change the actual app code that runs on the hardware wallet, so it cannot introduce a security vulnerability in shipped firmwar…
This commit is a routine cleanup of the project's unit-test code. It removes duplicate mock implementations of a small helper function called `pic()` from 14 test files and places a single shared version in a mock header. The change only a…
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queueddocs: Add user documentationby Salvatore Ingala · f32a3610 · Jun 24, 2026 · 4 filesMessage 87 · StrongTriage 0Details
Commit message · Salvatore Ingala
docs: Add user documentation
Existing documentation is rather detailed on the wire protocol, but lacks a higher level technical overview of the features and operating principles of the app.
This commit adds two new high-level guides for technical readers that are not interested in the details of the wire protocol:
- features.md: high-level overview of the app's features - integration.md: integration concepts and security model
Also, wallet.md was trimmed to avoid repeating what is in BIP-388.
87/100 · StrongMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Names security-relevant behavior explicitly
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: security-sensitive path
AI review queuedSIGHASH gating: status screen on disabled rejectionby Ilya Artemov · 0e35a24d · Jun 23, 2026 · 4 filesMessage 50 · ThinTriage 12Details
Commit message · Ilya Artemov
SIGHASH gating: status screen on disabled rejection
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
✓ Descriptive subject✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedSIGHASH gating: implementationby Ilya Artemov · 296bed60 · Jun 23, 2026 · 6 filesMessage 35 · OpaqueTriage 12Details
Commit message · Ilya Artemov
SIGHASH gating: implementation
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI review queuedRemove bad include directive with CFLAGSby Charles-Edouard de la Vergne · 704b361a · Jun 16, 2026 · 2 filesMessage 45 · ThinTriage 12Details
Commit message · Charles-Edouard de la Vergne
Remove bad include directive with CFLAGS
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedUnit tests for get_extended_pubkeyby Salvatore Ingala · 88fa41c7 · Jun 16, 2026 · 4 filesMessage 68 · AdequateTriage 17Details
Commit message · Salvatore Ingala
Unit tests for get_extended_pubkey
Refactored the handler_get_extended_pubkey to move the actual logic (after APDU parsing) into a separate function get_extended_pubkey_response, which get be tested directly based on the test vectors.
Rafactored some common TOML utilities into toml_helpers.h.