Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
51/100 average clarity
33Strong · 80–100
316Adequate · 60–79
513Thin · 40–59
191Opaque · 0–39
33security candidates with opaque commit messaging
This commit fixes a mobile UI bug where pressing Cancel on a 'building transaction' dialog accidentally closed one too many screens. The fix moves the responsibility for closing the dialog into each screen's cancel handler, and prevents er…
No security-relevant signals in the diffUI-only navigation and error-dialog suppression changesNo cryptographic, authentication, authorization, or data-handling changes
This commit is a routine merge from the project's staging branch into a feature branch. The visible code changes fix small UI/UX bugs in Stack Wallet's send screens: clearing an internal address-validation cache when the form is reset, mak…
Clearing stale address-provider state on form reset reduces the risk of stale validation data influencing a subsequent transactionFee-form caching prevents repeated network calls and accidental fee UI flicker/state races on rebuildQR scan buttons are UX additions with no visible parser/validation logic changes
This commit fixes a desktop wallet bug where the send-fee form would repeatedly re-fetch fee estimates on every screen rebuild, wasting resources and possibly flickering. It now caches the fee estimate and only retries if the previous fetc…
No security-relevant signals present in diff or commit metadataChange is a UI/UX performance and reliability improvement
This commit merges a feature branch into another work-in-progress branch. It adds QR-code scanning buttons to two desktop token send screens and resets an internal address-validation state variable when the send form is cleared. There is n…
State reset added to clearForm() to avoid stale validation dataNew QR scan entry points in token send flows (UI feature, not a vulnerability signal)
This change fixes a UI state bug in the cryptocurrency wallet's send form. When a user clears the send form, the app now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing…
UI state desynchronization between form field and validity indicatorPotential user confusion from stale valid-address stateNo input validation, cryptographic, or network-layer changes
This commit adds a QR code scanner button to two desktop cryptocurrency send forms. It is a straightforward user-interface feature addition with no apparent security relevance.
This commit adds a missing QR code scan button to two desktop token send screens in the Stack Wallet app. It is a straightforward user-interface fix that restores a feature already present on mobile and other send views; there is no indica…
This commit is purely a code-formatting cleanup. It changes line breaks and indentation in four user-interface files so the code is easier to read, but it does not change what the app actually does. There is no security relevance.
This commit fixes a UI bug in the desktop version of Stack Wallet where the send amount could be lost while the app was trying to estimate transaction fees. The fix keeps the amount 'alive' in memory so fee estimation does not accidentally…
State lifecycle issue in UI provider could lead to loss of user inputFix prevents fee estimation from silently resetting send amount to zeroNo cryptographic, authentication, or network security changes present
This commit updates the Stack Wallet app so that when a single payment is broken into multiple cryptocurrency transactions, the user sees a clear warning on the confirmation screen. It also changes the app's internal record-keeping to hand…
UI now warns users when a payment will be split into multiple on-chain transactionsInternal transaction model changed from single txid to list of txidsMultiple confirmation flows updated to iterate over all txids for notes and trade lookups
This commit fixes a performance bug in the desktop version of Stack Wallet where the app repeatedly re-fetched Bitcoin-style fee rates every time the on-screen fee form rebuilt. The change caches the fee result and only fetches again if th…
Unnecessary repeated network requests reducedFuture result cached to avoid re-execution on widget rebuildError path clears cache to allow retry
This commit fixes a UI state bug in Stack Wallet's send form. When a user clears the send form, the wallet now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing an old ad…
Stale UI state after form resetAddress validity not synchronized with address field resetPotential UI confusion leading to incorrect send confirmation
This is a large feature/fix merge that restores and rewrites the Xelis (XEL) cryptocurrency integration in Stack Wallet. It swaps the old hand-rolled Xelis code for a new generated native interface (XWF), adds wallet restore/backup support…
Send-flow lifecycle hardening: prepared Xelis transactions are now discarded via cancelSend when the user cancels or the widget is disposedSession-generation checks prevent stale wallet handles from being used after close/reopenMutex serialization added around send preparation, balance, history, and rescan operations
This commit is a large merge that mainly adds integration tests for a desktop 'forgot password' reset feature and makes supporting code changes to safely shut down background database workers during that reset. It also removes a large set …
New integration tests exercise a destructive 'forgot password' data-wipe featureTests assert that password store and wallet key store are deleted on successful resetTests assert that wallet files are deleted while backup and tor state are preserved
This commit lets users type multi-line notes when editing transaction and trade notes, and fixes the desktop layout so long notes scroll instead of breaking the screen. It also swaps the old `mounted` check for the newer `context.mounted` …
This commit is a large merge that mainly removes old integration tests and adds new desktop 'forgot password' reset tests. It also adds a safe-shutdown path for background Firo cache workers and databases. The changes look like defensive h…
Added safe shutdown of Firo cache isolates/SQLite databases before reset exitNew integration tests verify desktop forgot-password reset deletes secrets and preserves backupsTest harness intercepts exit() and IOOverrides to observe reset side effects
This commit fixes the desktop "forgot password" reset flow in Stack Wallet. It adds integration tests that verify the app can securely wipe its own data when a user forgets the desktop password, and it updates the Firo cache worker to clos…
Desktop password reset now closes Firo cache workers and SQLite databases before deleting app data, reducing the risk of data leakage or corruption during wipeNew integration tests assert that a successful reset removes password store (hive/desktopdata.hive), wallet key store (isar/desktopStore.isar), and wallet files while preserving backups and tor stateFailed reset scenario leaves a .reset-pending marker and removes password/key stores first, preventing the reset from being undone after partial deletion
This commit is a large merge that mainly adds a new 'prove you own a Spark address' feature to the Stack Wallet app, plus some related fixes. It also updates a dependency that handles SOCKS5 proxy connections and changes how the app decide…
New cryptographic signing path added: SparkInterface.signMessage now delegates to Spark ownership proof creation using the wallet's private key and spark derivation path.Ownership proof code rejects view-only wallets and blank messages, and searches a 100-address lookahead for the requested address before signing.Dependency upgrade: socks5_proxy 1.0.3+dev.3 -> 2.1.1, which may change SOCKS5/Tor proxy behavior; a new test verifies hostname/onion routing through a fake SOCKS server.
This commit adds a new feature to Stack Wallet that lets users prove they own a Spark (privacy) address by generating a cryptographic ownership proof. It also improves the sign/verify screens so view-only wallets can still verify proofs, a…
New cryptographic proof generation using private key material (privateKeyHex, spendKeyIndex, diversifier) inside an isolateView-only wallet guard added for proof creation (throws if isViewOnly)Message whitespace now preserved for pasted/typed challenge messages, preventing proof/verification mismatches caused by silent trimming
This commit merges several changes into a development branch. The most notable security-relevant change is a fix for how the Trocador exchange service routes traffic: it now automatically uses Tor (an anonymity network) when the user has T…
Trocador exchange API previously forced clearnet (`isOnion: false`) at every call site, bypassing Tor even when enabledNew `_useTor` getter centralizes Tor routing decision based on app feature flag and user preferenceOnion service address rotated to a new v3 .onion hostname
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a purely cosmetic user-interface tweak. It changes how a 'Review offer' button and product text are arranged on the screen depending on whether the app is running on desktop or mobile. There is no security relevance.
Security candidatefix(ui): more navigation and layout/styling cleanupby julian · e915b025 · May 27, 2026 · 5 filesMessage 62 · AdequateInformational 15Details
Commit message · julian
fix(ui): more navigation and layout/styling cleanup
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a routine user-interface cleanup for a shopping feature inside the Stack Wallet app. It swaps some dialog widgets, adjusts button layouts, and makes desktop and mobile navigation behave the same way. There is no indication it fixes a security problem.
fix(ui): fix keyboard covering textfield/dialog on mobile
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit fixes a minor user-interface bug in a mobile dialog. When a user opens a text field inside a dialog on a phone, the on-screen keyboard can slide up and cover the field. The change adds padding equal to the keyboard's height so the dialog shifts out of the way. There is no security relevance in the diff itself.
Security candidatefix(ui): mobile button height/sizeby julian · 571fc325 · May 27, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · julian
fix(ui): mobile button height/size
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit adjusts the height of two buttons (Cancel and Confirm) in a settings dialog so that on mobile devices the buttons use a default height instead of a fixed large height. It is purely a user-interface layout fix with no security relevance.
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit only adds error logging to a car-fee invoice creation screen. It does not change how user data is handled, how money moves, or how the app protects itself. It simply records more details when something goes wrong, so developers can diagnose issues later. There is no security problem here.
Security candidatefeat(shopinbit): migrate to PUT /payment for 1.0.4by sneurlax · e2306338 · May 26, 2026 · 3 filesMessage 62 · AdequateInformational 12Details
Commit message · sneurlax
feat(shopinbit): migrate to PUT /payment for 1.0.4
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 12/100
This commit updates the Stack Wallet app's integration with the ShopinBit service. It changes how a payment invoice is created: previously the app used a GET request (which could accidentally create invoices), and now it uses a PUT request after the user clicks 'PAY NOW'. This is a normal API migration to match a new ShopinBit specification version 1.0.4. There is no direct evidence in the commit of a security vulnerability being fixed or introduced.
fix(shopinbit): escape non-ASCII in request bodies
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 37/100
This commit fixes a bug in the Stack Wallet app's integration with ShopInBit, a third-party shopping service. When users sent text containing non-English characters (like ± or emoji), the app encoded them incorrectly before sending over the internet. This could corrupt order details, shipping names, or item descriptions, potentially causing orders to fail or be processed with wrong information. The fix forces all special characters to be sent as safe ASCII escape sequences.
Security candidatefix(shopinbit): GET payment first, PUT only if no live invoiceby sneurlax · 0f51d51c · May 26, 2026 · 1 fileMessage 62 · AdequateLow 32Details
Commit message · sneurlax
fix(shopinbit): GET payment first, PUT only if no live invoice
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 32/100
This commit changes how Stack Wallet's ShopInBit payment screen fetches an invoice. Previously it always created or regenerated a payment invoice with a PUT request. Now it first checks with a GET request and only creates a new invoice if no live one exists. This is a defensive fix to avoid overwriting or regenerating an existing valid invoice, which could disrupt a payment in progress or cause funds to be sent to a stale address.
AI review queuedRevert incorrect conflict resolution.by Dan Miller · 8208fe7e · May 26, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Dan Miller
Revert incorrect conflict resolution.
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
This commit simply removes a GitHub Actions workflow job that automatically packaged and published release files when a new version tag was created. It is a routine revert of a previous merge-conflict resolution and does not change any wallet code, cryptography, or user-facing security behavior.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidateRevert "feat(shopinbit): backfill remote tickets into the local db on refresh"by julian · 33571449 · May 26, 2026 · 1 fileMessage 65 · AdequateLow 26Details
Commit message · julian
Revert "feat(shopinbit): backfill remote tickets into the local db on refresh"
This reverts commit 91dc8229c456aeed2795b23e51e788963241778e.
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
authentication path
AI analysis · Low 26/100
This commit undoes a recent feature that copied remote customer support tickets into the app's local database during refresh. The revert removes the backfill step, so tickets created on another device or the web dashboard will no longer automatically appear in the local database. The change is described as a routine revert, not a security fix, and no public references explain why it was reverted.
Security candidatefix(ui): nav bugby julian · d0a3ee9c · May 26, 2026 · 1 fileMessage 40 · ThinInformational 11Details
Commit message · julian
fix(ui): nav bug
40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 11/100
This is a small user-interface navigation fix. The developer removed an unused wrapper widget and now directly calls the close action when a desktop user clicks a button. There is no indication this change affects security, user data, or wallet funds.
Security candidatefeat(shopinbit): recover requestDescription and detect travel on restoreby sneurlax · ab93fe03 · May 26, 2026 · 1 fileMessage 62 · AdequateInformational 18Details
Commit message · sneurlax
feat(shopinbit): recover requestDescription and detect travel on restore
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 18/100
This commit fixes a small data-recovery bug in Stack Wallet's integration with the ShopInBit shopping service. When a user restored their wallet or reopened an existing support ticket, the app had been storing an empty description and could not tell whether the ticket was for travel or the general concierge service. The patch recovers the original request text from the first message and uses a simple text pattern to detect travel bookings. There is no sign this exposes user funds, private keys, or allows remote attacks; it is a correctness improvement for how existing ticket data is displayed and categorized.
Security candidatefeat(shopinbit): backfill remote tickets into the local db on refreshby sneurlax · 91dc8229 · May 26, 2026 · 1 fileMessage 62 · AdequateInformational 12Details
Commit message · sneurlax
feat(shopinbit): backfill remote tickets into the local db on refresh
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 12/100
This commit adds a feature that downloads a user's complete order/ticket list from a remote service and saves any missing entries into the local database when the app refreshes. It is a routine data-synchronization improvement, not a security fix.
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit finishes a previously stubbed-out feature that downloads a customer's support/order tickets from an external service (ShopinBit) and stores them locally in the wallet's database. It is a normal feature implementation. There is no direct evidence in the commit that it fixes a security vulnerability, but it touches sensitive data (customer key, ticket messages) and makes network calls, so a defensive review checks for obvious safety issues.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidateadd shopinbit fetch all from remote function stubby julian · 59a2eeaf · May 26, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · julian
add shopinbit fetch all from remote function stub
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit adds a placeholder (stub) function for a future feature. It does not contain any working code, does not change how the app currently behaves, and introduces no security issue. The new function immediately throws an error if called, which is normal for unfinished development.
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit simply corrects an error message text. When a part of the app called ShopInBitService is used before being set up, the thrown error now tells the user to call ensureInitialized() instead of the outdated init(). There is no security change.
Lower-priorityui: "infinite" scrolling list view clean up and other little thingsby julian · c458074b · May 26, 2026 · 4 filesMessage 50 · ThinTriage 0Details
Commit message · julian
ui: "infinite" scrolling list view clean up and other little things
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedwip use "infinite" scrolling list viewby julian · c7c1c870 · May 25, 2026 · 2 filesMessage 25 · OpaqueInformational 15Details
Commit message · julian
wip use "infinite" scrolling list view
25/100 · OpaqueMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body! Contains work-in-progress language
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit is a routine user-interface refactor. It replaces a one-shot list of gift-card vendors with an 'infinite scroll' list that loads more cards as the user scrolls, and updates the backend client to return paginated results. There is no security-relevant change visible in the diff.
Lower-priorityai gen scrollable "paginated" listviewby julian · 6ff89fa1 · May 25, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · julian
ai gen scrollable "paginated" listview
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityfix: cakepay countries endpointby julian · 35f4ea9a · May 25, 2026 · 2 filesMessage 47 · ThinTriage 0Details
Commit message · julian
fix: cakepay countries endpoint
47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityrefactor(ui): mobile home view top menu clean upby julian · bc6c63f8 · May 25, 2026 · 2 filesMessage 57 · ThinTriage 0Details
Commit message · julian
refactor(ui): mobile home view top menu clean up
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body