Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
51/100 average clarity
33Strong · 80–100
316Adequate · 60–79
513Thin · 40–59
191Opaque · 0–39
33security candidates with opaque commit messaging
This commit fixes a mobile UI bug where pressing Cancel on a 'building transaction' dialog accidentally closed one too many screens. The fix moves the responsibility for closing the dialog into each screen's cancel handler, and prevents er…
No security-relevant signals in the diffUI-only navigation and error-dialog suppression changesNo cryptographic, authentication, authorization, or data-handling changes
This commit is a routine merge from the project's staging branch into a feature branch. The visible code changes fix small UI/UX bugs in Stack Wallet's send screens: clearing an internal address-validation cache when the form is reset, mak…
Clearing stale address-provider state on form reset reduces the risk of stale validation data influencing a subsequent transactionFee-form caching prevents repeated network calls and accidental fee UI flicker/state races on rebuildQR scan buttons are UX additions with no visible parser/validation logic changes
This commit fixes a desktop wallet bug where the send-fee form would repeatedly re-fetch fee estimates on every screen rebuild, wasting resources and possibly flickering. It now caches the fee estimate and only retries if the previous fetc…
No security-relevant signals present in diff or commit metadataChange is a UI/UX performance and reliability improvement
This commit merges a feature branch into another work-in-progress branch. It adds QR-code scanning buttons to two desktop token send screens and resets an internal address-validation state variable when the send form is cleared. There is n…
State reset added to clearForm() to avoid stale validation dataNew QR scan entry points in token send flows (UI feature, not a vulnerability signal)
This change fixes a UI state bug in the cryptocurrency wallet's send form. When a user clears the send form, the app now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing…
UI state desynchronization between form field and validity indicatorPotential user confusion from stale valid-address stateNo input validation, cryptographic, or network-layer changes
This commit adds a QR code scanner button to two desktop cryptocurrency send forms. It is a straightforward user-interface feature addition with no apparent security relevance.
This commit adds a missing QR code scan button to two desktop token send screens in the Stack Wallet app. It is a straightforward user-interface fix that restores a feature already present on mobile and other send views; there is no indica…
This commit is purely a code-formatting cleanup. It changes line breaks and indentation in four user-interface files so the code is easier to read, but it does not change what the app actually does. There is no security relevance.
This commit fixes a UI bug in the desktop version of Stack Wallet where the send amount could be lost while the app was trying to estimate transaction fees. The fix keeps the amount 'alive' in memory so fee estimation does not accidentally…
State lifecycle issue in UI provider could lead to loss of user inputFix prevents fee estimation from silently resetting send amount to zeroNo cryptographic, authentication, or network security changes present
This commit updates the Stack Wallet app so that when a single payment is broken into multiple cryptocurrency transactions, the user sees a clear warning on the confirmation screen. It also changes the app's internal record-keeping to hand…
UI now warns users when a payment will be split into multiple on-chain transactionsInternal transaction model changed from single txid to list of txidsMultiple confirmation flows updated to iterate over all txids for notes and trade lookups
This commit fixes a performance bug in the desktop version of Stack Wallet where the app repeatedly re-fetched Bitcoin-style fee rates every time the on-screen fee form rebuilt. The change caches the fee result and only fetches again if th…
Unnecessary repeated network requests reducedFuture result cached to avoid re-execution on widget rebuildError path clears cache to allow retry
This commit fixes a UI state bug in Stack Wallet's send form. When a user clears the send form, the wallet now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing an old ad…
Stale UI state after form resetAddress validity not synchronized with address field resetPotential UI confusion leading to incorrect send confirmation
This is a large feature/fix merge that restores and rewrites the Xelis (XEL) cryptocurrency integration in Stack Wallet. It swaps the old hand-rolled Xelis code for a new generated native interface (XWF), adds wallet restore/backup support…
Send-flow lifecycle hardening: prepared Xelis transactions are now discarded via cancelSend when the user cancels or the widget is disposedSession-generation checks prevent stale wallet handles from being used after close/reopenMutex serialization added around send preparation, balance, history, and rescan operations
This commit is a large merge that mainly adds integration tests for a desktop 'forgot password' reset feature and makes supporting code changes to safely shut down background database workers during that reset. It also removes a large set …
New integration tests exercise a destructive 'forgot password' data-wipe featureTests assert that password store and wallet key store are deleted on successful resetTests assert that wallet files are deleted while backup and tor state are preserved
This commit lets users type multi-line notes when editing transaction and trade notes, and fixes the desktop layout so long notes scroll instead of breaking the screen. It also swaps the old `mounted` check for the newer `context.mounted` …
This commit is a large merge that mainly removes old integration tests and adds new desktop 'forgot password' reset tests. It also adds a safe-shutdown path for background Firo cache workers and databases. The changes look like defensive h…
Added safe shutdown of Firo cache isolates/SQLite databases before reset exitNew integration tests verify desktop forgot-password reset deletes secrets and preserves backupsTest harness intercepts exit() and IOOverrides to observe reset side effects
This commit fixes the desktop "forgot password" reset flow in Stack Wallet. It adds integration tests that verify the app can securely wipe its own data when a user forgets the desktop password, and it updates the Firo cache worker to clos…
Desktop password reset now closes Firo cache workers and SQLite databases before deleting app data, reducing the risk of data leakage or corruption during wipeNew integration tests assert that a successful reset removes password store (hive/desktopdata.hive), wallet key store (isar/desktopStore.isar), and wallet files while preserving backups and tor stateFailed reset scenario leaves a .reset-pending marker and removes password/key stores first, preventing the reset from being undone after partial deletion
This commit is a large merge that mainly adds a new 'prove you own a Spark address' feature to the Stack Wallet app, plus some related fixes. It also updates a dependency that handles SOCKS5 proxy connections and changes how the app decide…
New cryptographic signing path added: SparkInterface.signMessage now delegates to Spark ownership proof creation using the wallet's private key and spark derivation path.Ownership proof code rejects view-only wallets and blank messages, and searches a 100-address lookahead for the requested address before signing.Dependency upgrade: socks5_proxy 1.0.3+dev.3 -> 2.1.1, which may change SOCKS5/Tor proxy behavior; a new test verifies hostname/onion routing through a fake SOCKS server.
This commit adds a new feature to Stack Wallet that lets users prove they own a Spark (privacy) address by generating a cryptographic ownership proof. It also improves the sign/verify screens so view-only wallets can still verify proofs, a…
New cryptographic proof generation using private key material (privateKeyHex, spendKeyIndex, diversifier) inside an isolateView-only wallet guard added for proof creation (throws if isViewOnly)Message whitespace now preserved for pasted/typed challenge messages, preventing proof/verification mismatches caused by silent trimming
This commit merges several changes into a development branch. The most notable security-relevant change is a fix for how the Trocador exchange service routes traffic: it now automatically uses Tor (an anonymity network) when the user has T…
Trocador exchange API previously forced clearnet (`isOnion: false`) at every call site, bypassing Tor even when enabledNew `_useTor` getter centralizes Tor routing decision based on app feature flag and user preferenceOnion service address rotated to a new v3 .onion hostname
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Lower-priorityrefactor(ui): general color and status label functions for CakePayOrderStatusby julian · 23bdf8c8 · May 6, 2026 · 2 filesMessage 62 · AdequateTriage 0Details
Commit message · julian
refactor(ui): general color and status label functions for CakePayOrderStatus
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfix(ui): change purple icon to something more in line with other settings type iconsby julian · 08ea5971 · May 6, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · julian
fix(ui): change purple icon to something more in line with other settings type icons
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatechore(source structure/naming): organize and name accordinglyby julian · 931d2058 · May 6, 2026 · 5 filesMessage 62 · AdequateInformational 15Details
Commit message · julian
chore(source structure/naming): organize and name accordingly
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit simply moves three Dart files from one folder to another and updates the corresponding import paths. It is a routine code organization change with no visible security implications.
Security candidateui(desktop shopinbit): clean up look and feelby julian · 43bb7e31 · May 6, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · julian
ui(desktop shopinbit): clean up look and feel
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a purely cosmetic user-interface update for the desktop ShopInBit setup screen. It swaps some visual widgets, removes an unused focus highlight, adjusts padding and layout, and makes the dialog height adapt to the window size. There is no security-relevant change.
Lower-priorityfix(ui): merge conflict clean up mistakeby julian · d8fae92a · May 6, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · julian
fix(ui): merge conflict clean up mistake
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityPre-install stable Rust toolchain for iOS cargokit buildby Dan Miller · 41cecbd5 · May 6, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Dan Miller
Pre-install stable Rust toolchain for iOS cargokit build
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityPre-install Rust stable toolchain in CI imageby Dan Miller · a0c8757b · May 6, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Dan Miller
Pre-install Rust stable toolchain in CI image
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityremove 20.04 instructions to stay coherent with prerequisitesby Cyrix126 · 099a3a8b · May 6, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Cyrix126
remove 20.04 instructions to stay coherent with prerequisites
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityRun dart run coinlib:build_windows to build secp256k1.dll for Windowsby Dan Miller · 1dd4615b · May 5, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Dan Miller
Run dart run coinlib:build_windows to build secp256k1.dll for Windows
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queuedfix(ui): do not expand unless space for content is requiredby julian · 830823f3 · May 5, 2026 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · julian
fix(ui): do not expand unless space for content is required
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a minor user-interface layout fix. It changes a dialog box so it only expands vertically when its content actually needs the extra space, rather than always stretching to fill available screen height. There is no indication this relates to security.
Lower-priorityUpdate Android job to use docker image with go preinstalledby Dan Miller · 1814da03 · May 5, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Dan Miller
Update Android job to use docker image with go preinstalled
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidateBump flutter_libmwc to v0.1.2 (iOS shasum fix)by Dan Miller · d0ecc2dc · May 5, 2026 · 1 fileMessage 45 · ThinInformational 10Details
Commit message · Dan Miller
Bump flutter_libmwc to v0.1.2 (iOS shasum fix)
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 10/100
This commit updates a single cryptocurrency plugin dependency (flutter_libmwc) to version 0.1.2, with the stated reason being an iOS checksum ('shasum') fix. The actual code changes are not visible because the diff was not provided. A checksum fix normally means a downloaded file's hash was corrected so the build can verify it was not corrupted or tampered with during download. It is a build-integrity issue, not a live vulnerability in the wallet itself, unless the wrong checksum was hiding a malicious replacement. There is no evidence in the supplied materials of malicious intent or a security breach.
Lower-priorityDeal with CI runner windows VS quirksby Dan Miller · 94adbb1e · May 5, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Dan Miller
Deal with CI runner windows VS quirks
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityAdd verbosity to linux CI build to see errors flutter coversby Dan Miller · 55bb1f79 · May 5, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Dan Miller
Add verbosity to linux CI build to see errors flutter covers
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Security candidateBump submodule pins for macOS download portability fixby Dan Miller · b4ba0305 · May 5, 2026 · 3 filesMessage 50 · ThinInformational 3Details
Commit message · Dan Miller
Bump submodule pins for macOS download portability fix
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 3/100
This commit only updates three submodule pointers (flutter_libepiccash, flutter_libmwc, and frostdart) with the stated purpose of fixing a macOS download portability issue. No actual code changes are shown, and no verified references were provided. There is no direct evidence in the commit of any security vulnerability.
Lower-priorityfix(ci): update build docs to handle ci related submodule tags correctlyby julian · 7f00b9a4 · May 5, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · julian
fix(ci): update build docs to handle ci related submodule tags correctly
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queuedformat modified Dart filesby levoncrypto · 2a614467 · May 5, 2026 · 6 filesMessage 35 · OpaqueInformational 15Details
Commit message · levoncrypto
format modified Dart files
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is purely a code-formatting cleanup. It adjusts line breaks, indentation, and whitespace across six Dart files to match the project's style rules. No functionality, logic, or security behavior was changed.
AI review queuedset isChange=false for ProReg recipientby levoncrypto · 65112ae6 · May 5, 2026 · 1 fileMessage 45 · ThinLow 41Details
Commit message · levoncrypto
set isChange=false for ProReg recipient
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 41/100
This commit changes a single flag in the Firo cryptocurrency wallet code. When creating a special 'ProReg' transaction used for masternode registration, the wallet now marks a small recipient output as 'not change' rather than 'change.' In many wallet designs, change outputs are handled differently from payment outputs—potentially affecting how fees are calculated, how the output is selected in future spending, or how the transaction is displayed to the user. The change is too small and context-free to conclude it fixes a serious vulnerability, but it is a plausible correctness or security-related fix for a coin-specific transaction type.
AI review queuedadd some safeguardsby julian · f6a7cae6 · May 5, 2026 · 1 fileMessage 28 · OpaqueInformational 23Details
Commit message · julian
add some safeguards
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 23/100
This commit makes a small UI safety tweak in the transaction confirmation screen of a cryptocurrency wallet. It moves a database lookup slightly later in the code and ensures a state update happens after the screen has finished its initial build, which helps avoid a rare Flutter framework error. There is no direct evidence this fixes a security vulnerability, but it is a defensive safeguard against possible app crashes or inconsistent UI state when checking whether a transaction would accidentally spend a valuable 'ordinal' asset.
Security candidateBump frostdart submodule to v0.1.3by Dan Miller · 23613701 · May 5, 2026 · 1 fileMessage 60 · AdequateInformational 4Details
Commit message · Dan Miller
Bump frostdart submodule to v0.1.3
Brings in the openssl + openssl-sys MSRV pins for rustc 1.71.
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 4/100
This commit updates a submodule called frostdart to version 0.1.3. The stated reason is to pin two related software libraries (openssl and openssl-sys) to versions compatible with an older Rust compiler version (1.71). There is no code change visible in the commit itself, only a submodule pointer update. No security issue is described or evident from the materials provided.
Lower-priorityci(android): drop ndk.abiFilters to allow --split-per-abiby Dan Miller · faf3f30b · May 5, 2026 · 1 fileMessage 85 · StrongTriage 0Details
Commit message · Dan Miller
ci(android): drop ndk.abiFilters to allow --split-per-abi
AGP rejects ndk.abiFilters alongside the abi splits config that `flutter build apk --split-per-abi` enables. Drop the explicit filter in the Android build.gradle template; Flutter's default android-arm, android-arm64, android-x64 set is what we want anyway, and the CI's APK-renaming step already references those ABI names.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Lower-priorityci(linux): use system jsoncpp/libsecret to unblock flutter build linuxby Dan Miller · 69e4e68e · May 5, 2026 · 2 filesMessage 97 · StrongTriage 0Details
Commit message · Dan Miller
ci(linux): use system jsoncpp/libsecret to unblock flutter build linux
The Linux CI step ran flutter build linux --release without first building the local jsoncpp/libsecret artifacts that linux/CMakeLists.txt hardcoded, so ninja failed looking for scripts/linux/build/jsoncpp/.../libjsoncpp.so.
Add a USE_SYSTEM_SECURE_STORAGE_DEPS switch to the Linux CMakeLists template: when set (or the same-named env var is "1"), link against the pkg-config-resolved system jsoncpp and libsecret-1 and bundle the .so files from their reported libdir; otherwise keep the existing local-build path used by scripts/linux/build_all.sh. Set USE_SYSTEM_SECURE_STORAGE_DEPS=1 on the build-linux job, where the stackwallet-ci image already provides libjsoncpp-dev and libsecret-1-dev.
97/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
documentation-only discount
Security candidateUpdate frostdart submoduleby Dan Miller · 86139a13 · May 5, 2026 · 1 fileMessage 35 · OpaqueInformational 2Details
Commit message · Dan Miller
Update frostdart submodule
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive path
AI analysis · Informational 2/100
This commit only updates a Git submodule pointer for 'frostdart' inside the Stack Wallet repository. No actual code changes are shown, and no security-related description is provided. On its own, this tells us nothing about whether the submodule update fixes or introduces a security issue.
Lower-priorityAdd workflow to publish prebuilt mwebd.exe as a release assetby Dan Miller · c5005a0b · May 5, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Dan Miller
Add workflow to publish prebuilt mwebd.exe as a release asset
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queuedAdd opt-in --fetch path for mwebd.exe Windows buildby Dan Miller · cc9438dd · May 5, 2026 · 2 filesMessage 50 · ThinLow 39Details
Commit message · Dan Miller
Add opt-in --fetch path for mwebd.exe Windows build
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 39/100
This commit adds an optional shortcut for Windows builds that downloads a pre-built 'mwebd.exe' program from the internet instead of compiling it from source. It checks the downloaded file against a published SHA-256 hash, but the download itself uses plain HTTPs and the source URL can be overridden by an environment variable. There is no claim in the commit that this fixes a security issue; it appears to be a build-convenience change.