Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit fixes a small but meaningful bug in the Ledger Bitcoin app's code that handles advanced multi-signature (MuSig) operations. A function called crypto_tr_lift_x can fail when given an invalid x-coordinate that does not correspond…
Unchecked return value from cryptographic point-lifting functionPotential use of invalid/uninitialized curve point in MuSig signing flowMissing error propagation in compressed public-key parsing
This commit hardens a Bitcoin transaction parser in Ledger's app. It changes some numeric fields to safer types, adds bounds checks on transaction counts and sizes, rejects extra trailing bytes after a transaction, checks a previously-igno…
Integer type narrowing and sentinel change from -1 to SIZE_MAXBounds checks before uint64_t to unsigned int castsReturn value of parser_consolidate_buffers now checked
This commit changes what information the Ledger Bitcoin app shows on its screen when signing a transaction that includes 'external inputs'—coins the user did not provide and whose amounts the device cannot independently verify. Previously …
UI/UX hardening: additional contextual data shown for transactions with unverified external inputsNo change to cryptographic checks, sighash validation, or input verificationExternal inputs warning is preserved; new data is displayed only when the input set is closed (no ANYONECANPAY)
This commit only updates test screenshot snapshots for the Ledger Bitcoin app. It does not change any application source code, so it cannot directly fix or introduce a security vulnerability in the shipped app. The snapshots reflect new ex…
No source-code changes in the commitOnly test snapshot images (PNG) are modified or addedCommit title references trustworthy amount/fee display for non-default sighash, suggesting a prior functional change exists elsewhere
This commit only adds and updates automated integration tests for the Ledger Bitcoin app. It does not change the app's actual signing code. The tests verify that the device now shows clearer, more trustworthy on-screen amount and fee infor…
No C/device firmware code changesTest-only commit adjusting UI navigation expectationsNew tests assert that negative fees are rejected for default sighash but allowed/relabeled for ANYONECANPAY sighash
This commit only adds new automated unit tests for functions that decide how transaction amounts and fees are displayed on a Ledger device when signing a Bitcoin transaction with non-standard signature hash (sighash) modes. It does not cha…
Commit title references trustworthy amount/fee display for non-default sighash, a historically sensitive area in hardware-wallet signing UITests cover sighash commitment semantics (SIGHASH_NONE, SIGHASH_SINGLE, SIGHASH_ANYONECANPAY combinations) that directly affect what outputs a signature commits toNo functional code changes in this commit; only unit-test additions
This commit changes how the Ledger Bitcoin app shows transaction amounts and fees on the device screen when a user signs a transaction that does not use the normal 'sign everything' rule (a so-called non-default sighash). Previously the ap…
This commit is a small code cleanup in the Ledger Bitcoin app. It removes an initial loop that counted commands and instead checks for the end marker directly while processing. The author says the old loop was unnecessary and caused a harm…
Commit message explicitly frames the change as removing a redundant scan and a static-analysis false positive, not as a security fix.No change to parsing, cryptography, authorization, or transaction semantics.Functional behavior for valid command lists is equivalent before and after the patch.
This commit only fixes a documentation/declaration inconsistency in a C header file. The function parameter name in the comment is changed from `in_len` to `inlen` to match the actual declaration, and the output pointer is annotated with a…
This commit adds test-only helper code for creating Bitcoin transaction fixtures that support newer wallet types (MuSig2 multi-signature and several legacy/wrapped SegWit descriptor forms). It is not a change to the Ledger app firmware its…
No security-relevant signal: change is in test utilities onlyAdds cryptographic helper for MuSig2 key aggregation in test fixturesAdds P2SH/P2SH-P2WPKH/P2SH-P2WSH script generation in test fixtures
This commit is purely a build-system and test-harness cleanup. It refactors CMakeLists.txt, updates comments, simplifies the speculos test bridge, and removes a workaround in a test file. Nothing here changes the actual Ledger Bitcoin app …
This commit only adds new unit tests and renames some existing test functions. It does not change any production code behavior, so it cannot introduce a security vulnerability or fix one on its own.
This commit only adds unit tests and a test-only bridge implementation for cryptographic signing functions. It does not change the actual device application code that users rely on, so it cannot introduce a security vulnerability in the sh…
This commit is a test-only refactoring: it removes a set of local mock SDK headers and a software SHA-256 implementation used by unit tests, and instead makes those tests run against the real Ledger SDK headers through the existing Speculo…
No production code changesTest infrastructure refactoring onlyRemoval of local cryptographic mock in favor of real SDK/speculos bridge
This commit is purely about improving the project's automated test setup. It links unit tests to a software simulator (Speculos) so cryptographic code can be tested on a regular computer without a physical Ledger device. It adds tests for …
This commit is purely a testing infrastructure cleanup. It removes a workaround called SKIP_FOR_CMOCKA that previously hid parts of the code from unit tests, and instead compiles those parts using a more realistic emulator bridge (speculos…
This commit only adds unit tests and test-support code. It does not change the actual Bitcoin app that runs on Ledger devices, so it cannot introduce a security vulnerability in shipped firmware. The changes make the test harness able to s…
This commit only adds helper functions for unit tests to convert Bitcoin extended public keys (xpubs) between base58 string form and raw binary form. It does not change the actual Ledger app code that runs on the device, nor does it fix or…
This commit only adds unit tests and test infrastructure for Bitcoin Taproot cryptographic helpers. It does not change the actual app code that runs on the hardware wallet, so it cannot introduce a security vulnerability in shipped firmwar…
This commit is a routine cleanup of the project's unit-test code. It removes duplicate mock implementations of a small helper function called `pic()` from 14 test files and places a single shared version in a mock header. The change only a…
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedRefactor the common pre-pass between produce_musig2_pubnonces and sign_transactionby Salvatore Ingala · 8d96347b · May 11, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Salvatore Ingala
Refactor the common pre-pass between produce_musig2_pubnonces and sign_transaction
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedadd CODEOWNERSby Mathias BROUSSET · 4001e47f · May 7, 2026 · 1 fileMessage 18 · OpaqueTriage 0Details
Commit message · Mathias BROUSSET
add CODEOWNERS
18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
AI review queuedReplace VarInt with custom UncheckedVarIntby Salvatore Ingala · 6a66e4e2 · May 7, 2026 · 5 filesMessage 68 · AdequateTriage 19Details
Commit message · Salvatore Ingala
Replace VarInt with custom UncheckedVarInt
rust-bitcoin version 0.32.9 started enforcing a consensus rule that VarInt objects are at most 0x02000000, while the Bitcoin app protocol uses it for arbitrary numbers up to 64 bits.
UncheckedVarInt works for any u64.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathparser or protocol pathsecond-pass: security-sensitive path
AI review queuedupdate crate deploymentby Mathias BROUSSET · 7d19c7a3 · May 4, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Mathias BROUSSET
update crate deployment
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedMake sure raw_witnessUtxo is long enough before reading its 9th byteby Salvatore Ingala · 6f818772 · Mar 27, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Salvatore Ingala
Make sure raw_witnessUtxo is long enough before reading its 9th byte
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedDocument public functions in parser_ext.hby Salvatore Ingala · f36a2dcb · Mar 27, 2026 · 1 fileMessage 45 · ThinTriage 7Details
Commit message · Salvatore Ingala
Document public functions in parser_ext.h
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedUpdate Ragger snapshotsby Ilya Artemov · 0e55e907 · Mar 26, 2026 · 1090 filesMessage 28 · OpaqueTriage 12Details
Commit message · Ilya Artemov
Update Ragger snapshots
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
AI review queuedDecreasing stack consumption: Nano X test adaptationby Ilya Artemov · 4fd088d7 · Mar 26, 2026 · 3 filesMessage 60 · AdequateTriage 12Details
Commit message · Ilya Artemov
Decreasing stack consumption: Nano X test adaptation
60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedAccount for terminating '\0' in maximum length of ext_pubkey_strby Salvatore Ingala · 5b68a255 · Mar 24, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Salvatore Ingala
Account for terminating '\0' in maximum length of ext_pubkey_str
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedCorrect allocation size for musig_infoby Salvatore Ingala · 22f4ff76 · Mar 24, 2026 · 1 fileMessage 60 · AdequateTriage 12Details
Commit message · Salvatore Ingala
Correct allocation size for musig_info
They both happen to be 4, so fortuitously not a bug on 32-bit ARM
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedAdd a maximum recursion depth to parse_scriptby Salvatore Ingala · 9d89c28c · Mar 24, 2026 · 1 fileMessage 45 · ThinTriage 12Details
Commit message · Salvatore Ingala
Add a maximum recursion depth to parse_script
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path