Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit fixes nine separate bugs in the Monero Light Wallet Server (LWS). The most serious ones are: an infinite loop when importing certain address data, a missing size limit that let unauthenticated remote clients request huge amount…
Infinite loop in database import path (DoS)Missing authentication-time message size limit on remote scanner protocol (memory exhaustion / DoS)Untrusted array reads from client in light wallet RPC
This commit fixes a broken GitHub Actions workflow file that builds and publishes Docker images. It corrects a variable name (from 'platform' to 'arch') and adds a missing period at the end of the docker build command. There is no security…
This commit fixes a YAML indentation error in a GitHub Actions workflow file. It changes one line of spacing so the Docker login step is correctly aligned under the job's steps list. There is no security-relevant change to the software its…
This commit fixes a typo in a GitHub Actions workflow file. The Docker build command had an extra word ('build build') that would cause the automated Docker image build to fail. It is a routine CI/CD fix with no security relevance.
This commit fixes a GitHub Actions workflow syntax error. The 'matrix' keyword was missing its required parent 'strategy' wrapper, which would prevent Docker build jobs from running correctly. There is no security relevance in the code cha…
This commit is a routine compatibility update to keep the Monero Light Wallet Server (LWS) project building against recent changes in the upstream Monero codebase. It replaces a custom macro-based type declaration (POD_CLASS) with plain C+…
No security-relevant behavioral changes in the diffChanges are limited to forward-declaration style and missing header includesNo memory safety, cryptographic, input validation, or authorization changes observed
This commit fixes a type-casting mistake in the Monero Light Wallet Server's database code. The program was treating its own custom database context as a different, more generic context. That mismatch could corrupt internal accounting of a…
Wrong context cast in LMDB transaction cleanup (type confusion)Custom context reference counting could be corrupted by mismatched deleterLarge code removal reduces attack surface and eliminates duplicated LMDB wrappers
This commit fixes a simple syntax typo in a GitHub Actions workflow file. The condition that decides whether to add release tags had an extra closing brace, which would cause the workflow to fail parsing rather than run incorrectly. There …
This commit only updates the 'external/monero' git submodule pointer from one commit hash to another. No actual source code changes are shown in this repository's diff. The title and message are generic ('Latest master') and give no indica…
This commit fixes a bug in the Monero Light Wallet Server (LWS) where webhook notifications for mempool transactions could fail or behave incorrectly when scanning subaddresses. The change passes an existing database reader into the output…
Fixes a read-transaction lifecycle issue in webhook lookup during mempool scanningAdds regression test covering mempool publication + webhook deliveryCallback signature change propagates an existing storage_reader to avoid nested/duplicate reads
This commit simply adds a new GPG public key file to the repository. A GPG public key is used to verify that future releases or commits were genuinely signed by the project maintainer. There is no code change, no vulnerability, and no secu…
This commit is a routine build/maintenance change that adjusts which version of the external Monero dependency is pinned. There is no indication of any security fix, vulnerability, or user-facing behavior change. It is essentially a housek…
This commit appears to change which version of an external Monero component the project points to (a so-called 'git submodule pin' or dependency reference). The title says it fixes the pin for 'external/master' back to the 'master' branch.…
This commit fixes a database-handling bug in Monero Light Wallet Server (LWS). The bug caused the server to permanently miss some subaddress outputs because a read transaction was not closed before a new one was opened, triggering an LMDB …
Fixes LMDB transaction-slot error (MDB_BAD_RSLOT)Prevents permanently missed subaddress outputsChanges test expectations to reflect recovered output
This commit fixes a math mistake when checking whether a user requested too many Monero subaddresses. The original code divided two numbers and compared the result to a maximum, which is the wrong way to detect overflow and could allow the…
Integer overflow check corrected from an inverted/incorrect comparison to a canonical safe division pre-checkOccurs in subaddress limit enforcement, which is a security boundary against excessive address derivationSame bug pattern present in two independent locations (storage and REST server)
This commit simply changes a version string from '1.0-alpha' to '1.1-alpha' in a single source file. There is no functional code change, no bug fix, and no security relevance visible in the diff or commit message.
This commit changes one character in the documentation configuration file (mkdocs.yml), adding a trailing slash to the site description. It does not touch any program code, cryptographic logic, network handling, or user data. There is no s…
This commit is a routine documentation-site fix. It changes how the MkDocs documentation builder is invoked in a GitHub Actions workflow (from `python3 mkdocs build` to `python3 -m mkdocs build`) and fixes a typo in the site description. T…
This commit makes a trivial wording change to the project's documentation configuration file, adding a slash to the site description. There is no security relevance.
This commit adds mempool (pending transaction) support to Monero Light Wallet Server. It lets users see unconfirmed transactions through the /get_address_txs REST endpoint and the live /feed websocket. The change also refactors how the ser…
Large feature commit (+1906/-634) touching REST, WebSocket feed, scanner, and new mempool componentRefactored transaction ownership scanning into shared ownership_test helper; reduces duplicated crypto/derivation logicMempool transactions are parsed and validated before being added to the local cache in /submit_raw_tx
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedLatest masterby Lee *!* Clagett · 248e9148 · Aug 8, 2026 · 1 fileMessage 18 · OpaqueInformational 15Details
Commit message · Lee *!* Clagett
Latest master
18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit only updates the 'external/monero' git submodule pointer from one commit hash to another. No actual source code changes are shown in this repository's diff. The title and message are generic ('Latest master') and give no indication of what changed in the submodule. Without inspecting the submodule's own commits, we cannot determine any security relevance from the materials provided.
Lower-priorityTry another external/monero/master fixby Lee *!* Clagett · 85ac6b37 · Aug 8, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Lee *!* Clagett
Try another external/monero/master fix
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityUpdate external/monero to match develop branchby Lee *!* Clagett · 840f7da5 · Aug 8, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Lee *!* Clagett
Update external/monero to match develop branch
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidateFix mempool webhook read during subaddress scanning (#283)by Lee *!* Clagett · 89e90f58 · Aug 8, 2026 · 6 filesMessage 58 · ThinLow 35Details
Commit message · Lee *!* Clagett
Fix mempool webhook read during subaddress scanning (#283)
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
privacy or spend-authorization protocol
AI analysis · Low 35/100
This commit fixes a bug in the Monero Light Wallet Server (LWS) where webhook notifications for mempool transactions could fail or behave incorrectly when scanning subaddresses. The change passes an existing database reader into the output-handling callback, so the code no longer tries to start a new read transaction inside an already-active one. This prevents potential failures or inconsistent reads during mempool webhook processing. The commit also adds tests that exercise the mempool publication path with a webhook server.
Lower-priorityFix shared locking in lmdb map resizing (#281)by Lee *!* Clagett · e70e1e2a · Aug 8, 2026 · 2 filesMessage 53 · ThinTriage 0Details
Commit message · Lee *!* Clagett
Fix shared locking in lmdb map resizing (#281)
53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100
This commit simply adds a new GPG public key file to the repository. A GPG public key is used to verify that future releases or commits were genuinely signed by the project maintainer. There is no code change, no vulnerability, and no security issue in the diff itself.
Lower-priorityAdd docker tagging for specific tags/releasesby Lee Clagett · 7d15da2b · Aug 3, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Lee Clagett
Add docker tagging for specific tags/releases
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
access control
AI analysis · Informational 11/100
This commit is a routine build/maintenance change that adjusts which version of the external Monero dependency is pinned. There is no indication of any security fix, vulnerability, or user-facing behavior change. It is essentially a housekeeping update to a submodule reference.
Security candidateFix external/master pin back to masterby Lee *!* Clagett · d7f8ef46 · Jul 16, 2026 · 1 fileMessage 45 · ThinInformational 4Details
Commit message · Lee *!* Clagett
Fix external/master pin back to master
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
access control
AI analysis · Informational 4/100
This commit appears to change which version of an external Monero component the project points to (a so-called 'git submodule pin' or dependency reference). The title says it fixes the pin for 'external/master' back to the 'master' branch. No actual code changes are visible, and no security-related information is provided in the commit message or materials.
Fix `MDB_BAD_RSLOT` in `subaddress_reader::update_reader()` causing permanently missed subaddress outputs (#278)
* fix: regtest * fix: MDB_BAD_RSLOT
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
privacy or spend-authorization protocol
AI analysis · Moderate 56/100
This commit fixes a database-handling bug in Monero Light Wallet Server (LWS). The bug caused the server to permanently miss some subaddress outputs because a read transaction was not closed before a new one was opened, triggering an LMDB error (MDB_BAD_RSLOT). The fix explicitly releases the old read transaction before starting the next one. There is no direct evidence this is exploitable by an attacker; it appears to be a reliability/correctness bug.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Fix docker build with upstream (Monero) changes (#273)
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityFix ZMQ reading after upstream max msg size changes (#271)by Lee *!* Clagett · 4286c1c5 · Jul 3, 2026 · 1 fileMessage 58 · ThinTriage 0Details
Commit message · Lee *!* Clagett
Fix ZMQ reading after upstream max msg size changes (#271)
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Add --lws-server-external to safeguard unintended usage (#270)
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
✓ Descriptive subject✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityAdd macos-26 to the CI runner. This is (indirectly) used via 'macos-latest' (#267)by Lee *!* Clagett · 62a71837 · Jul 3, 2026 · 1 fileMessage 58 · ThinTriage 0Details
Commit message · Lee *!* Clagett
Add macos-26 to the CI runner. This is (indirectly) used via 'macos-latest' (#267)
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Fix integer overflow check in subaddress handling (#264)
63/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
memory safetyprivacy or spend-authorization protocol
AI analysis · Moderate 59/100
This commit fixes a math mistake when checking whether a user requested too many Monero subaddresses. The original code divided two numbers and compared the result to a maximum, which is the wrong way to detect overflow and could allow the multiplication to overflow. The fix reverses the division so the check works correctly. A malicious or malformed request might have been able to bypass the subaddress limit, though the practical effect depends on what happens after the check.
Fix build against monero/master (boost cmake changes) (#265)
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityFix 'real' output in msgpack (#260)by Lee *!* Clagett · eb666884 · May 28, 2026 · 4 filesMessage 53 · ThinTriage 0Details
Commit message · Lee *!* Clagett
Fix 'real' output in msgpack (#260)
53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityFix msgpack small negative integer output (#258)by Lee *!* Clagett · dd56a62b · May 26, 2026 · 3 filesMessage 53 · ThinTriage 0Details
Commit message · Lee *!* Clagett
Fix msgpack small negative integer output (#258)
53/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
AI review queuedBump branch to 1.1-alphaby Lee *!* Clagett · fb599e8a · May 23, 2026 · 1 fileMessage 38 · OpaqueInformational 15Details
Commit message · Lee *!* Clagett
Bump branch to 1.1-alpha
38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit simply changes a version string from '1.0-alpha' to '1.1-alpha' in a single source file. There is no functional code change, no bug fix, and no security relevance visible in the diff or commit message.
Lower-priorityYet another attempt at GH Deploymentby Lee *!* Clagett · 17eefa18 · May 23, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Lee *!* Clagett
Yet another attempt at GH Deployment
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body