Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
51/100 average clarity
33Strong · 80–100
316Adequate · 60–79
513Thin · 40–59
191Opaque · 0–39
33security candidates with opaque commit messaging
This commit fixes a mobile UI bug where pressing Cancel on a 'building transaction' dialog accidentally closed one too many screens. The fix moves the responsibility for closing the dialog into each screen's cancel handler, and prevents er…
No security-relevant signals in the diffUI-only navigation and error-dialog suppression changesNo cryptographic, authentication, authorization, or data-handling changes
This commit is a routine merge from the project's staging branch into a feature branch. The visible code changes fix small UI/UX bugs in Stack Wallet's send screens: clearing an internal address-validation cache when the form is reset, mak…
Clearing stale address-provider state on form reset reduces the risk of stale validation data influencing a subsequent transactionFee-form caching prevents repeated network calls and accidental fee UI flicker/state races on rebuildQR scan buttons are UX additions with no visible parser/validation logic changes
This commit fixes a desktop wallet bug where the send-fee form would repeatedly re-fetch fee estimates on every screen rebuild, wasting resources and possibly flickering. It now caches the fee estimate and only retries if the previous fetc…
No security-relevant signals present in diff or commit metadataChange is a UI/UX performance and reliability improvement
This commit merges a feature branch into another work-in-progress branch. It adds QR-code scanning buttons to two desktop token send screens and resets an internal address-validation state variable when the send form is cleared. There is n…
State reset added to clearForm() to avoid stale validation dataNew QR scan entry points in token send flows (UI feature, not a vulnerability signal)
This change fixes a UI state bug in the cryptocurrency wallet's send form. When a user clears the send form, the app now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing…
UI state desynchronization between form field and validity indicatorPotential user confusion from stale valid-address stateNo input validation, cryptographic, or network-layer changes
This commit adds a QR code scanner button to two desktop cryptocurrency send forms. It is a straightforward user-interface feature addition with no apparent security relevance.
This commit adds a missing QR code scan button to two desktop token send screens in the Stack Wallet app. It is a straightforward user-interface fix that restores a feature already present on mobile and other send views; there is no indica…
This commit is purely a code-formatting cleanup. It changes line breaks and indentation in four user-interface files so the code is easier to read, but it does not change what the app actually does. There is no security relevance.
This commit fixes a UI bug in the desktop version of Stack Wallet where the send amount could be lost while the app was trying to estimate transaction fees. The fix keeps the amount 'alive' in memory so fee estimation does not accidentally…
State lifecycle issue in UI provider could lead to loss of user inputFix prevents fee estimation from silently resetting send amount to zeroNo cryptographic, authentication, or network security changes present
This commit updates the Stack Wallet app so that when a single payment is broken into multiple cryptocurrency transactions, the user sees a clear warning on the confirmation screen. It also changes the app's internal record-keeping to hand…
UI now warns users when a payment will be split into multiple on-chain transactionsInternal transaction model changed from single txid to list of txidsMultiple confirmation flows updated to iterate over all txids for notes and trade lookups
This commit fixes a performance bug in the desktop version of Stack Wallet where the app repeatedly re-fetched Bitcoin-style fee rates every time the on-screen fee form rebuilt. The change caches the fee result and only fetches again if th…
Unnecessary repeated network requests reducedFuture result cached to avoid re-execution on widget rebuildError path clears cache to allow retry
This commit fixes a UI state bug in Stack Wallet's send form. When a user clears the send form, the wallet now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing an old ad…
Stale UI state after form resetAddress validity not synchronized with address field resetPotential UI confusion leading to incorrect send confirmation
This is a large feature/fix merge that restores and rewrites the Xelis (XEL) cryptocurrency integration in Stack Wallet. It swaps the old hand-rolled Xelis code for a new generated native interface (XWF), adds wallet restore/backup support…
Send-flow lifecycle hardening: prepared Xelis transactions are now discarded via cancelSend when the user cancels or the widget is disposedSession-generation checks prevent stale wallet handles from being used after close/reopenMutex serialization added around send preparation, balance, history, and rescan operations
This commit is a large merge that mainly adds integration tests for a desktop 'forgot password' reset feature and makes supporting code changes to safely shut down background database workers during that reset. It also removes a large set …
New integration tests exercise a destructive 'forgot password' data-wipe featureTests assert that password store and wallet key store are deleted on successful resetTests assert that wallet files are deleted while backup and tor state are preserved
This commit lets users type multi-line notes when editing transaction and trade notes, and fixes the desktop layout so long notes scroll instead of breaking the screen. It also swaps the old `mounted` check for the newer `context.mounted` …
This commit is a large merge that mainly removes old integration tests and adds new desktop 'forgot password' reset tests. It also adds a safe-shutdown path for background Firo cache workers and databases. The changes look like defensive h…
Added safe shutdown of Firo cache isolates/SQLite databases before reset exitNew integration tests verify desktop forgot-password reset deletes secrets and preserves backupsTest harness intercepts exit() and IOOverrides to observe reset side effects
This commit fixes the desktop "forgot password" reset flow in Stack Wallet. It adds integration tests that verify the app can securely wipe its own data when a user forgets the desktop password, and it updates the Firo cache worker to clos…
Desktop password reset now closes Firo cache workers and SQLite databases before deleting app data, reducing the risk of data leakage or corruption during wipeNew integration tests assert that a successful reset removes password store (hive/desktopdata.hive), wallet key store (isar/desktopStore.isar), and wallet files while preserving backups and tor stateFailed reset scenario leaves a .reset-pending marker and removes password/key stores first, preventing the reset from being undone after partial deletion
This commit is a large merge that mainly adds a new 'prove you own a Spark address' feature to the Stack Wallet app, plus some related fixes. It also updates a dependency that handles SOCKS5 proxy connections and changes how the app decide…
New cryptographic signing path added: SparkInterface.signMessage now delegates to Spark ownership proof creation using the wallet's private key and spark derivation path.Ownership proof code rejects view-only wallets and blank messages, and searches a 100-address lookahead for the requested address before signing.Dependency upgrade: socks5_proxy 1.0.3+dev.3 -> 2.1.1, which may change SOCKS5/Tor proxy behavior; a new test verifies hostname/onion routing through a fake SOCKS server.
This commit adds a new feature to Stack Wallet that lets users prove they own a Spark (privacy) address by generating a cryptographic ownership proof. It also improves the sign/verify screens so view-only wallets can still verify proofs, a…
New cryptographic proof generation using private key material (privateKeyHex, spendKeyIndex, diversifier) inside an isolateView-only wallet guard added for proof creation (throws if isViewOnly)Message whitespace now preserved for pasted/typed challenge messages, preventing proof/verification mismatches caused by silent trimming
This commit merges several changes into a development branch. The most notable security-relevant change is a fix for how the Trocador exchange service routes traffic: it now automatically uses Tor (an anonymity network) when the user has T…
Trocador exchange API previously forced clearnet (`isOnion: false`) at every call site, bypassing Tor even when enabledNew `_useTor` getter centralizes Tor routing decision based on app feature flag and user preferenceOnion service address rotated to a new v3 .onion hostname
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Lower-priorityci: add android Docker stage to fix build-android disk exhaustionby Dan Miller · 7c5c44f6 · May 22, 2026 · 3 filesMessage 62 · AdequateTriage 0Details
Commit message · Dan Miller
ci: add android Docker stage to fix build-android disk exhaustion
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfall back to stub external_api_keys.dart on fork PRsby Dan Miller · 89258e5b · May 22, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Dan Miller
fall back to stub external_api_keys.dart on fork PRs
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queuedAdd flatpak build job to CIby Dan Miller · 8e44e2c3 · May 22, 2026 · 5 filesMessage 45 · ThinInformational 15Details
Commit message · Dan Miller
Add flatpak build job to CI
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds a new automated build step that packages the existing Linux version of Stack Wallet as a Flatpak installer. It does not change the wallet's actual code, only the build/release pipeline and packaging metadata. There is no indication of a security fix or vulnerability.
Lower-priorityDrop release workflow to keep it manualby Dan Miller · aef1e9d1 · May 22, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Dan Miller
Drop release workflow to keep it manual
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityci: embed Flathub runtime-repo in flatpak bundleby Dan Miller · 60daf640 · May 22, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Dan Miller
ci: embed Flathub runtime-repo in flatpak bundle
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queuedflatpak: grant filesystem access to ~/.stackwalletby Dan Miller · 8b704da0 · May 22, 2026 · 1 fileMessage 50 · ThinLow 29Details
Commit message · Dan Miller
flatpak: grant filesystem access to ~/.stackwallet
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 29/100
This change updates the Flatpak packaging for Stack Wallet so the app can read and write files in the user's ~/.stackwallet folder. This is likely needed so the wallet can store its data outside the sandbox. By itself, granting access to a dedicated wallet directory is a routine, expected permission change and not a vulnerability. However, it slightly widens the app's sandbox escape surface because a bug or malicious component inside the app could now access, modify, or delete files in that folder, including wallet backups or configuration data.
Lower-priorityci: package Windows as zip, add Android AAB, add format extensions to artifact namesby Dan Miller · 3429b61a · May 22, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Dan Miller
ci: package Windows as zip, add Android AAB, add format extensions to artifact names
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityci: add build-campfire-linux and build-stack-duo-linux jobsby Dan Miller · fef38a86 · May 22, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Dan Miller
ci: add build-campfire-linux and build-stack-duo-linux jobs
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Security candidaterefactor(shopinbit): remove ticket count from "My requests" buttonby sneurlax · c3197dc5 · May 22, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax
refactor(shopinbit): remove ticket count from "My requests" button
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit simply removes a small UI feature that showed the number of open support tickets on a 'My requests' button in the ShopInBit service area. The button still works and opens the requests page; it just no longer displays the count. There is no security relevance visible in the change.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 20/100
This commit is a user-interface refactor for two third-party order/payment features (CakePay and ShopInBit). It moves order loading and polling out of the UI screens into dedicated background services, adds pull-to-refresh and refresh buttons, and removes full-screen loading spinners that previously blocked the app. There is no direct evidence in the commit that it fixes a security vulnerability; it appears aimed at improving responsiveness and fixing UI lock-ups.
Lower-priorityci: package Windows as zip, add Android AAB, add format extensions to artifact namesby Dan Miller · 70df0e56 · May 22, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Dan Miller
ci: package Windows as zip, add Android AAB, add format extensions to artifact names
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityDrop release workflow to keep it manualby Dan Miller · 4f3927e5 · May 22, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Dan Miller
Drop release workflow to keep it manual
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityci: add build-campfire-linux and build-stack-duo-linux jobsby Dan Miller · 9571fae8 · May 22, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Dan Miller
ci: add build-campfire-linux and build-stack-duo-linux jobs
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
feat(shopinbit): add warning dialog when closing mid-flow
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 19/100
This commit adds a confirmation dialog that asks users 'Are you sure you want to close?' when they click the X button partway through a ShopInBit or CakePay purchase flow. Previously, the X button could close the whole checkout window unexpectedly, which might cause a user to lose their place or abandon a payment. There is no sign of a security vulnerability being fixed; it is a usability improvement to prevent accidental closure.
Security candidatefeat(shopinbit): don't repetitively ask for the user's display nameby sneurlax · 3bf4f8b9 · May 22, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax
feat(shopinbit): don't repetitively ask for the user's display name
it's already been set
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a small user-experience improvement for the ShopinBit feature in Stack Wallet. It skips a screen that repeatedly asks the user for their display name when that name has already been saved. There is no security issue visible in the change.
AI review queuedhide/disable shopinbit/cakepay based on app features flagsby julian · fd8bb87b · May 22, 2026 · 6 filesMessage 50 · ThinInformational 15Details
Commit message · julian
hide/disable shopinbit/cakepay based on app features flags
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit simply hides or shows two app features—ShopinBit and CakePay gift cards—based on configuration flags. It is a normal UI customization change, not a security fix or vulnerability.
Security candidatefix(shopinbit): handle timestamps from the API consistentlyby sneurlax · 7cff09c4 · May 22, 2026 · 1 fileMessage 77 · AdequateInformational 16Details
Commit message · sneurlax
fix(shopinbit): handle timestamps from the API consistently
whether they have the timezone suffix or not
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
authentication path
AI analysis · Informational 16/100
This commit is a small UI fix for the ShopInBit ticket detail screen. It changes how timestamps received from the API are displayed to users, making the formatting consistent whether or not the API includes timezone information. It also adds the date (e.g., 'Jan 5') when a message is not from today. There is no security issue visible in this change.
Security candidatefeat(shopinbit): migrate forms to AdaptiveTextField, delete step4 fieldby sneurlax · 79d4087c · May 22, 2026 · 6 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax
feat(shopinbit): migrate forms to AdaptiveTextField, delete step4 field
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a routine user-interface cleanup. It replaces several custom-built text input boxes in the ShopInBit shopping flow with a shared, reusable component called AdaptiveTextField, and removes an old, now-unused custom text field file. There is no indication this change fixes or introduces a security problem.
Security candidatefeat(ui): extend AdaptiveTextField and migrate travel form to use themby sneurlax · 248c83cb · May 22, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax
feat(ui): extend AdaptiveTextField and migrate travel form to use them
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a routine user-interface refactor. It extends a shared text-field widget so it can replace a travel-form-specific text field, and updates the travel booking form to use the shared widget. There is no security-relevant change visible in the diff.
Security candidatefix(ui): adjust ShopinBit travel form on desktop and mobileby sneurlax · 23746e3d · May 22, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax
fix(ui): adjust ShopinBit travel form on desktop and mobile
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a purely cosmetic user-interface tweak for a travel booking form inside the Stack Wallet app. It rounds the corners of text boxes, increases spacing between fields, and changes one placeholder label from an example to 'Destination city.' There is no security relevance.
AI review queuedhide/disable coin control view for salvium as the underlying library doesn't fully support itby julian · 75733fe4 · May 22, 2026 · 5 filesMessage 50 · ThinInformational 21Details
Commit message · julian
hide/disable coin control view for salvium as the underlying library doesn't fully support it
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 21/100
This commit hides the 'coin control' feature for Salvium wallets in the Stack Wallet app. Coin control lets users manually choose which coins (transaction outputs) to spend. The change blocks Salvium wallets from using that feature because the underlying library doesn't fully support it. It is a compatibility/bug-avoidance change rather than a fix for an active security flaw, but disabling the unsupported path reduces the chance of users accidentally creating broken or mis-handled transactions.
Security candidatehandle here instead of https://github.com/cypherstack/stack_wallet/pull/1345 due to conflicts that I don't want to deal withby julian · 6e9c01ed · May 22, 2026 · 1 fileMessage 70 · AdequateInformational 0Details
Commit message · julian
handle here instead of https://github.com/cypherstack/stack_wallet/pull/1345 due to conflicts that I don't want to deal with
70/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 0/100
There is not enough information to evaluate this commit. The title and message only say it is handling another pull request's changes here due to merge conflicts. No actual code diff was provided, and no verified references describe what the change does or whether it has security relevance.
AI review queuedfix: dart formattingby Cyrix126 · 98633ecc · May 22, 2026 · 1 fileMessage 40 · ThinInformational 15Details
Commit message · Cyrix126
fix: dart formatting
40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit only reformats Dart source code to match style rules. It changes whitespace, line breaks, and indentation but does not alter any program logic, behavior, or security controls.
AI review queuedflatpak: grant filesystem access to ~/.stackwalletby Dan Miller · f2c52c20 · May 22, 2026 · 1 fileMessage 50 · ThinLow 26Details
Commit message · Dan Miller
flatpak: grant filesystem access to ~/.stackwallet
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 26/100
This change updates the Flatpak packaging for Stack Wallet so the app can read and write files in a folder named .stackwallet inside the user's home directory. Flatpak apps normally run in a sandbox with limited access to the rest of the computer. The commit message only says this is being added to grant filesystem access to that folder; it does not say this fixes a security bug or that any vulnerability was reported.