MG
← All projectsMAGIC Grants

Skylight Wallet

Modern open-source self-custody Monero light wallet using Monero LWS.

MoneroPrivacy protocolsSoftware walletsNormal
Repository coverage

299 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

39security candidates178second-pass queue217AI analyses
77commits · 30 days
101commits · 60 days
139commits · 180 days
292commits · 365 days
Backfill bands
Sep 27 → Mar 31160 seen18 candidatesComplete
Mar 31 → Jul 2928 seen4 candidatesComplete
Jul 29 → Aug 2834 seen3 candidatesComplete
Aug 28 → Sep 2748 seen9 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

37/100 average clarity
0Strong · 80–100
10Adequate · 60–79
151Thin · 40–59
138Opaque · 0–39
17security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Keeqler25135185236
Justin Ehrenhofer42428240
Licaon_Kter302034
SamsungGalaxyPlayer202035
jermanuts100045
Analysis record

Published AI watches

Last scanned 48 minutes ago

Low 32 AI analysisMessage 58 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #178 from MAGICGrants/2.1.0-release-fixes

This is a routine version-2.1.0 bug-fix merge for the Skylight Monero wallet. The visible changes fix small packaging and platform-detection issues, add a new automated TLS test suite, and update pinned internal library versions. There is …

New native TLS integration test workflow covering all shipped platformsCA bundle asset handling moved into wallet-core (assets/cacert.pem removed from app asset list, copyCacertToAppDocumentsDir removed)Debian launcher LD_LIBRARY_PATH no longer includes empty trailing entry
320c02ceby Justin Ehrenhofer+383−362427 files
No security note in commit
Informational 3 AI analysisMessage 0 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Update pins

This commit only updates version numbers and the pinned Git commit references (called 'pins') for several software libraries the project depends on. No actual code in this repository was changed. The commit message simply says 'Update pins…

Dependency pin update to new commit hashes in external repositoriesNo source code changes in the skylight-wallet repository itselfNo commit message or in-diff indication of security relevance
7125d971by Justin Ehrenhofer+25−252 files
No security note in commit
Informational 0 AI analysisMessage 45 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'main' into 2.1.0-release-fixes

This commit is a routine Git merge that brings the latest changes from the 'main' branch into a release-fixes branch. The only changed files are precompiled binary libraries for Monero wallet support on Android, iOS, Linux, and Windows. No…

50b25b5eby Justin Ehrenhofer+0−07 files
No security note in commit
Informational 18 AI analysisMessage 35 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Skip fetching unused submodules

This commit changes three build scripts so they only download two specific submodules ('monero' and 'lwsf') instead of all submodules. The stated reason is reliability: unused submodules for other coins can cause build failures when their …

Build script change limiting submodule checkout scopeReduced fetch of third-party dependencies during buildNo direct vulnerability or exploit mechanism introduced
8c5b00d3by Justin Ehrenhofer+9−33 files
No security note in commit
Informational 0 AI analysisMessage 58 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #179 from MAGICGrants/update-moneroc-libs

This commit only updates precompiled Monero library files (binary .so and .dll files) across Android, iOS, Linux, and Windows. No source code changes are shown, and no description of what changed in the libraries is provided. We cannot det…

3df9967aby Justin Ehrenhofer+0−07 files
No security note in commit
Informational 0 AI analysisMessage 35 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Update monero_c libraries

This commit only updates precompiled Monero wallet library files (binary .so and .dll files) across Android, iOS, Linux, and Windows. No source code changes are shown, and no security-related information is provided in the commit title or …

2cf30607by SamsungGalaxyPlayer+0−07 files
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Fix desktop builds

This commit fixes broken build pipelines for Linux and Windows desktop releases. It pins the Rust toolchain version used during the Linux build and installs the NASM assembler on Windows so that a cryptography library can compile. There is…

e0eaa15fby Justin Ehrenhofer+11−22 files
No security note in commit
Low 34 AI analysisMessage 58 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #176 from MAGICGrants/desktop-ui

This is a large feature merge that adds a desktop user interface, re-enables Linux and Windows release builds, and makes several Android build and security-related changes. The most notable security-relevant change is a fix in the Android …

Android MainActivity blocks route/deeplink intent injection by returning null initial route and disabling deeplink handlingAndroid build split into Play and FOSS source sets to keep Google Play review library out of F-Droid/GitHub APKsNew StoreReview method channels on Android and iOS
d6d9d318by Justin Ehrenhofer+3922−151454 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 0 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bump build

This commit only changes the app's version number in a configuration file, bumping it from 2.0.0+410 to 2.1.0+411. There are no code changes, no security fixes, and no behavior changes visible in the diff.

993a1147by Justin Ehrenhofer+1−11 file
No security note in commit
Low 46 AI analysisMessage 45 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Updates for Monero 0.18.5.3

This commit updates the Skylight Wallet app to work with Monero 0.18.5.3, refreshes several internal library versions, re-enables Linux and Windows release builds, and adds two Android safeguards that prevent other apps or adb commands fro…

Exported Android MainActivity previously accepted route-bearing intents that could bypass App LockNew getInitialRoute() and shouldHandleDeeplinking() overrides neutralize route/deep-link injection on AndroidSubmodule/package bumps to monero_c and wallet-core may include undisclosed security fixes for Monero 0.18.5.3
5f5eea3eby Justin Ehrenhofer+37−296 files
No security note in commit
Informational 0 AI analysisMessage 58 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #175 from MAGICGrants/update-moneroc-libs

This commit updates pre-compiled Monero wallet library files across Android, iOS, Linux, and Windows. The actual code changes are inside binary files, so the diff shows no readable source changes. There is no information in the commit titl…

424f9588by Justin Ehrenhofer+0−07 files
No security note in commit
Informational 0 AI analysisMessage 35 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Update monero_c libraries

This commit only updates precompiled Monero library files (binary .so and .dll files) across Android, iOS, Linux, and Windows. No source code changes are shown, and no commit message or vendor reference explains what changed in these libra…

1e620a30by SamsungGalaxyPlayer+0−07 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Show fiat API failure as a warning triangle by the balance; aligns with Spice

This commit is a cosmetic user-interface change. It swaps a text-based fiat exchange-rate error message for a warning-triangle icon with a tooltip and shows the coin balance more clearly when the fiat rate is unavailable. There is no secur…

09609000by Keeqler+64−541 file
No security note in commit
Informational 15 AI analysisMessage 35 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Fix mobile screen transitions

This commit changes how screen transitions (animations) work in a mobile/desktop wallet app. It disables animated transitions on desktop entirely and keeps them only between navigation-bar screens on mobile. There is no security-relevant c…

9456bbbdby Keeqler+3−11 file
No security note in commit
Informational 18 AI analysisMessage 50 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Fix create password screen showing up on mobile; format

This commit fixes a UI bug where mobile users were incorrectly shown a 'create wallet password' screen that should only appear on desktop. On mobile, the app now skips that screen and creates or restores the wallet directly, relying on the…

Flow change: mobile wallet creation/restoration bypasses app-level password screenMobile now relies on device app lock instead of an in-app passwordDuplicate-submission guard added via _committing flag
6483d8a1by Keeqler+163−729 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge remote-tracking branch 'origin/send-wallet-core' into brightness-fix

This commit is a routine merge that moves fiat-currency handling into a shared library and adds a 'switch amount unit' feature on the send screen. There is no security-relevant change visible in the diff.

1f4209d3by Keeqler+77−10512 files
No security note in commit
Informational 23 AI analysisMessage 58 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #173 from MAGICGrants/review-prompt

This commit adds an in-app store review prompt. After a successful cryptocurrency send, it marks the user as eligible, and the next time they open the wallet home screen it may ask for a Google Play or App Store rating. The code deliberate…

Third-party SDK inclusion gated by build flavor (Google Play only)Install-source check before invoking Play review APIF-Droid reproducible-build compatibility via source-set exclusion and recipe deletion
6528c1cbby Keeqler+165−19 files
No security note in commit
Informational 17 AI analysisMessage 68 · Adequate
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'desktop-ui' into brightness-fix

This is a large merge commit that brings a new desktop user interface into the Skylight Wallet app. Most of the changes are UI layout, new desktop-specific screens, updated text strings, and build script tweaks. There is no obvious securit…

Large feature merge with 43 changed files and thousands of linesBuild script updates pinned appimagetool SHA256 and filenameNew desktop UI screens added; no security-critical logic visible
2932c7e0by Keeqler+3592−143843 files
No security note in commit
Informational 15 AI analysisMessage 0 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bump build

This commit only increases the app's internal build number from 409 to 410 in a configuration file. There are no code changes, no bug fixes, and no security-related modifications visible in the diff.

dcb087efby Keeqler+1−11 file
No security note in commit
Informational 15 AI analysisMessage 0 · Opaque
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bump build

This commit only increases the app's internal build number from 408 to 409 in a configuration file. No code, dependencies, or security settings were changed. There is no security relevance.

e69ac4eeby Keeqler+1−11 file
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateMake restore height optional, use polyseed restore date and add bip39 supportby Keeqler · b044227b · Dec 10, 2025 · 11 filesMessage 50 · ThinInformational 23Details
Commit message · Keeqler

Make restore height optional, use polyseed restore date and add bip39 support

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
secret or key materialcryptography-sensitive pathsigning or wallet path
AI analysis · Informational 23/100

This commit changes how users restore a Monero wallet in the Skylight Wallet app. It makes the 'restore height' field optional, automatically fills it for newer Polyseed seeds, and adds support for restoring from BIP39-style mnemonic phrases (common 12/24-word seeds). The changes are mostly usability improvements, but they touch sensitive wallet-recovery code and introduce new dependencies for seed handling. There is no direct evidence in the commit of a security vulnerability, but the new BIP39 conversion logic and the changed restore flow deserve careful review because mistakes here could lead to users restoring the wrong wallet or leaking keys.

Security candidateFix legacy seed restore failby Keeqler · fa0b1e87 · Dec 9, 2025 · 2 filesMessage 45 · ThinInformational 15Details
Commit message · Keeqler

Fix legacy seed restore fail

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
seed or entropy pathsigning or wallet path
AI analysis · Informational 15/100

This commit fixes a bug where restoring an older-style cryptocurrency wallet seed would fail. The app now also accepts a specific temporary 'No response from HTTP server' state from the underlying wallet library as a valid signal to proceed with the restore. It also removes an unused import in a seed-generation screen. There is no direct evidence this is a security vulnerability; it appears to be a reliability/bug-fix change.

Security candidateOptimize loading in generate seed screenby Keeqler · ded7bdf3 · Dec 5, 2025 · 3 filesMessage 45 · ThinInformational 16Details
Commit message · Keeqler

Optimize loading in generate seed screen

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
seed or entropy pathsigning or wallet path
AI analysis · Informational 16/100

This commit speeds up the wallet creation screen by fetching the blockchain height ahead of time and by running some setup steps in the background instead of waiting for each one to finish. The changes are framed as a performance optimization. There is no direct evidence in the commit that this fixes a security vulnerability, but it does change how sensitive wallet setup tasks are sequenced and how a shared cache is accessed.

Security candidatePin intlby Keeqler · 1dae3b40 · Dec 4, 2025 · 1 fileMessage 0 · OpaqueInformational 15Details
Commit message · Keeqler

Pin intl

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
access control
AI analysis · Informational 15/100

This commit changes a single dependency version in a Dart package file from a flexible version range (^0.20.2) to an exact pinned version (0.20.2). This is a routine build/dependency management change with no visible security relevance in the commit itself or supplied references.

Security candidatePin versionsby Keeqler · 72e05e62 · Dec 4, 2025 · 3 filesMessage 18 · OpaqueLow 34Details
Commit message · Keeqler

Pin versions

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
access control
AI analysis · Low 34/100

This commit locks down the exact versions of software building blocks used by the Skylight Wallet app and its Docker build image. It upgrades Flutter from 3.27.1 to 3.38.3, pins the Dart SDK to 3.10.1, and replaces flexible version ranges (like ^1.0.8) with exact versions in the project's dependency list. It also refreshes the lock file with newer patch/minor versions of many supporting libraries. The change is primarily a supply-chain hygiene improvement: it makes builds more reproducible and prevents unexpected future updates, but it also pulls in newer library versions that may contain routine bug and security fixes.

Security candidateFix max subaddresses warning bugby Keeqler · d4aadea1 · Nov 25, 2025 · 1 fileMessage 45 · ThinLow 25Details
Commit message · Keeqler

Fix max subaddresses warning bug

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
privacy or spend-authorization protocolsigning or wallet path
AI analysis · Low 25/100

This commit fixes a bug in a cryptocurrency wallet app where a warning about reaching the maximum number of subaddresses (separate receiving addresses) could appear at the wrong time or with wrong data. The changes remove a condition that only saved wallet state after transactions were loaded, and they stop assuming a default value of 1 when the saved subaddress index is missing. The security relevance is indirect: it mainly prevents user confusion and possible app misbehavior, not a direct theft or remote attack.

Security candidateFix some screens too wide on desktopby Keeqler · d033aa20 · Nov 11, 2025 · 3 filesMessage 45 · ThinInformational 15Details
Commit message · Keeqler

Fix some screens too wide on desktop

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
seed or entropy pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a routine user-interface layout fix. It limits how wide three wallet setup screens can stretch on desktop computers by wrapping them in a centered container with a maximum width. There is no security-relevant change.

Security candidateAdd subaddresses limit reached checkby Keeqler · 11ee322e · Oct 31, 2025 · 8 filesMessage 45 · ThinLow 36Details
Commit message · Keeqler

Add subaddresses limit reached check

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
privacy or spend-authorization protocolsigning or wallet path
AI analysis · Low 36/100

This commit adds a safety check to a cryptocurrency wallet so that, when the server can no longer create new subaddresses, the app warns the user and falls back to reusing an already-used subaddress instead of silently failing or leaking privacy. It is a defensive/privacy-hardening change, not an obvious vulnerability fix, but it addresses a real privacy edge case: address reuse weakens transaction privacy.

Security candidateMinor refactoring and subaddress check result cachingby Keeqler · 791f0f67 · Oct 30, 2025 · 8 filesMessage 50 · ThinInformational 14Details
Commit message · Keeqler

Minor refactoring and subaddress check result caching

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
privacy or spend-authorization protocolseed or entropy pathsigning or wallet path
AI analysis · Informational 14/100

This commit is a routine cleanup of a Monero wallet app. It mainly moves repeated startup steps into a single helper function, caches whether the server supports subaddresses in local app storage, and improves loading indicators on the connection setup screen. There is no obvious security bug introduced, but the change is not purely cosmetic because it alters when and how the app checks server capabilities and stores that result.

Security candidateAdd subaddress support checkby Keeqler · 03c9f0c5 · Oct 29, 2025 · 11 filesMessage 35 · OpaqueLow 37Details
Commit message · Keeqler

Add subaddress support check

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
privacy or spend-authorization protocolsigning or wallet path
AI analysis · Low 37/100

This commit adds a feature that checks whether the user's chosen Monero light-wallet server supports subaddresses. Before this change, the app could show a subaddress even when the server did not support it, which could cause incoming transactions to be missed. The change also removes a stored user preference that always defaulted to showing the primary address, and instead auto-detects server capability and defaults to showing a subaddress when supported. The most notable security-relevant side effect is that the app now sends the wallet's secret view key to the light-wallet server during the check, and it does so over plain HTTP unless the user has enabled SSL/Tor. That is a privacy-sensitive design choice, but it is consistent with how Monero light wallets already operate.

Security candidateSet up android app bundle signingby Keeqler · 9597a310 · Oct 22, 2025 · 5 filesMessage 45 · ThinInformational 15Details
Commit message · Keeqler

Set up android app bundle signing

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundaryauthentication path
AI analysis · Informational 15/100

This commit is a routine build configuration change. It sets up proper Android release signing (so the app can be published on app stores) and updates the app's package name and copyright strings across Android, iOS, macOS, and Windows from placeholder/example values to the real project identity (MAGIC Grants / Skylight Wallet). There is no security vulnerability here.

Security candidateBranding, terms of service and privacy policyby Keeqler · a64659f8 · Oct 10, 2025 · 95 filesMessage 45 · ThinInformational 15Details
Commit message · Keeqler

Branding, terms of service and privacy policy

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
seed or entropy pathsigning or wallet pathauthentication path
AI analysis · Informational 15/100

This commit is a routine rebranding and legal-disclosure update. It renames the app from 'monero_light_wallet' to 'skylight_wallet' across Android, iOS, macOS, Linux, Windows, and web; swaps the package name/namespace to 'org.magicgrants.skylight'; adds new launcher icons; and introduces in-app Terms of Service and Privacy Policy screens. There are no code changes that alter security behavior, cryptography, network handling, or data flow.

Security candidateDoneby Keeqler · 5e003b33 · Oct 3, 2025 · 5 filesMessage 0 · OpaqueLow 31Details
Commit message · Keeqler

Done

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
seed or entropy pathsigning or wallet path
AI analysis · Low 31/100

This commit appears to be a routine bug-fix and polish update for a Monero light wallet app. It fixes a broken wallet-delete routine (the old code compared a variable to null instead of actually setting it to null), improves connection status display, adds a timeout to stats loading, and ensures Tor is ready before fetching blockchain height. There is no clear security vulnerability being patched, and no vendor disclosure or researcher attribution is present.

Security candidateProgressby Keeqler · 70a920f8 · Sep 29, 2025 · 13 filesMessage 0 · OpaqueLow 26Details
Commit message · Keeqler

Progress

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
seed or entropy pathsigning or wallet path
AI analysis · Low 26/100

This commit is a routine development update titled 'Progress' for the Skylight Wallet app. It mainly refactors how the wallet object is handled (making it nullable to avoid crashes before a wallet is loaded), moves timer logic out of the home screen into a shared model, updates native Monero library files, and adjusts balance/transaction getters. There is no clear security fix or vulnerability being patched in the visible code changes.