Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
51/100 average clarity
33Strong · 80–100
316Adequate · 60–79
513Thin · 40–59
191Opaque · 0–39
33security candidates with opaque commit messaging
This commit fixes a mobile UI bug where pressing Cancel on a 'building transaction' dialog accidentally closed one too many screens. The fix moves the responsibility for closing the dialog into each screen's cancel handler, and prevents er…
No security-relevant signals in the diffUI-only navigation and error-dialog suppression changesNo cryptographic, authentication, authorization, or data-handling changes
This commit is a routine merge from the project's staging branch into a feature branch. The visible code changes fix small UI/UX bugs in Stack Wallet's send screens: clearing an internal address-validation cache when the form is reset, mak…
Clearing stale address-provider state on form reset reduces the risk of stale validation data influencing a subsequent transactionFee-form caching prevents repeated network calls and accidental fee UI flicker/state races on rebuildQR scan buttons are UX additions with no visible parser/validation logic changes
This commit fixes a desktop wallet bug where the send-fee form would repeatedly re-fetch fee estimates on every screen rebuild, wasting resources and possibly flickering. It now caches the fee estimate and only retries if the previous fetc…
No security-relevant signals present in diff or commit metadataChange is a UI/UX performance and reliability improvement
This commit merges a feature branch into another work-in-progress branch. It adds QR-code scanning buttons to two desktop token send screens and resets an internal address-validation state variable when the send form is cleared. There is n…
State reset added to clearForm() to avoid stale validation dataNew QR scan entry points in token send flows (UI feature, not a vulnerability signal)
This change fixes a UI state bug in the cryptocurrency wallet's send form. When a user clears the send form, the app now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing…
UI state desynchronization between form field and validity indicatorPotential user confusion from stale valid-address stateNo input validation, cryptographic, or network-layer changes
This commit adds a QR code scanner button to two desktop cryptocurrency send forms. It is a straightforward user-interface feature addition with no apparent security relevance.
This commit adds a missing QR code scan button to two desktop token send screens in the Stack Wallet app. It is a straightforward user-interface fix that restores a feature already present on mobile and other send views; there is no indica…
This commit is purely a code-formatting cleanup. It changes line breaks and indentation in four user-interface files so the code is easier to read, but it does not change what the app actually does. There is no security relevance.
This commit fixes a UI bug in the desktop version of Stack Wallet where the send amount could be lost while the app was trying to estimate transaction fees. The fix keeps the amount 'alive' in memory so fee estimation does not accidentally…
State lifecycle issue in UI provider could lead to loss of user inputFix prevents fee estimation from silently resetting send amount to zeroNo cryptographic, authentication, or network security changes present
This commit updates the Stack Wallet app so that when a single payment is broken into multiple cryptocurrency transactions, the user sees a clear warning on the confirmation screen. It also changes the app's internal record-keeping to hand…
UI now warns users when a payment will be split into multiple on-chain transactionsInternal transaction model changed from single txid to list of txidsMultiple confirmation flows updated to iterate over all txids for notes and trade lookups
This commit fixes a performance bug in the desktop version of Stack Wallet where the app repeatedly re-fetched Bitcoin-style fee rates every time the on-screen fee form rebuilt. The change caches the fee result and only fetches again if th…
Unnecessary repeated network requests reducedFuture result cached to avoid re-execution on widget rebuildError path clears cache to allow retry
This commit fixes a UI state bug in Stack Wallet's send form. When a user clears the send form, the wallet now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing an old ad…
Stale UI state after form resetAddress validity not synchronized with address field resetPotential UI confusion leading to incorrect send confirmation
This is a large feature/fix merge that restores and rewrites the Xelis (XEL) cryptocurrency integration in Stack Wallet. It swaps the old hand-rolled Xelis code for a new generated native interface (XWF), adds wallet restore/backup support…
Send-flow lifecycle hardening: prepared Xelis transactions are now discarded via cancelSend when the user cancels or the widget is disposedSession-generation checks prevent stale wallet handles from being used after close/reopenMutex serialization added around send preparation, balance, history, and rescan operations
This commit is a large merge that mainly adds integration tests for a desktop 'forgot password' reset feature and makes supporting code changes to safely shut down background database workers during that reset. It also removes a large set …
New integration tests exercise a destructive 'forgot password' data-wipe featureTests assert that password store and wallet key store are deleted on successful resetTests assert that wallet files are deleted while backup and tor state are preserved
This commit lets users type multi-line notes when editing transaction and trade notes, and fixes the desktop layout so long notes scroll instead of breaking the screen. It also swaps the old `mounted` check for the newer `context.mounted` …
This commit is a large merge that mainly removes old integration tests and adds new desktop 'forgot password' reset tests. It also adds a safe-shutdown path for background Firo cache workers and databases. The changes look like defensive h…
Added safe shutdown of Firo cache isolates/SQLite databases before reset exitNew integration tests verify desktop forgot-password reset deletes secrets and preserves backupsTest harness intercepts exit() and IOOverrides to observe reset side effects
This commit fixes the desktop "forgot password" reset flow in Stack Wallet. It adds integration tests that verify the app can securely wipe its own data when a user forgets the desktop password, and it updates the Firo cache worker to clos…
Desktop password reset now closes Firo cache workers and SQLite databases before deleting app data, reducing the risk of data leakage or corruption during wipeNew integration tests assert that a successful reset removes password store (hive/desktopdata.hive), wallet key store (isar/desktopStore.isar), and wallet files while preserving backups and tor stateFailed reset scenario leaves a .reset-pending marker and removes password/key stores first, preventing the reset from being undone after partial deletion
This commit is a large merge that mainly adds a new 'prove you own a Spark address' feature to the Stack Wallet app, plus some related fixes. It also updates a dependency that handles SOCKS5 proxy connections and changes how the app decide…
New cryptographic signing path added: SparkInterface.signMessage now delegates to Spark ownership proof creation using the wallet's private key and spark derivation path.Ownership proof code rejects view-only wallets and blank messages, and searches a 100-address lookahead for the requested address before signing.Dependency upgrade: socks5_proxy 1.0.3+dev.3 -> 2.1.1, which may change SOCKS5/Tor proxy behavior; a new test verifies hostname/onion routing through a fake SOCKS server.
This commit adds a new feature to Stack Wallet that lets users prove they own a Spark (privacy) address by generating a cryptographic ownership proof. It also improves the sign/verify screens so view-only wallets can still verify proofs, a…
New cryptographic proof generation using private key material (privateKeyHex, spendKeyIndex, diversifier) inside an isolateView-only wallet guard added for proof creation (throws if isViewOnly)Message whitespace now preserved for pasted/typed challenge messages, preventing proof/verification mismatches caused by silent trimming
This commit merges several changes into a development branch. The most notable security-relevant change is a fix for how the Trocador exchange service routes traffic: it now automatically uses Tor (an anonymity network) when the user has T…
Trocador exchange API previously forced clearnet (`isOnion: false`) at every call site, bypassing Tor even when enabledNew `_useTor` getter centralizes Tor routing decision based on app feature flag and user preferenceOnion service address rotated to a new v3 .onion hostname
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidatefix: fix randomx-rust for androidby sneurlax · e81816ee · Jan 12, 2026 · 1 fileMessage 57 · ThinInformational 2Details
Commit message · sneurlax
fix: fix randomx-rust for android
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
proof-of-work or emission validationcryptography-sensitive path
AI analysis · Informational 2/100
This commit claims to fix a RandomX Rust integration issue specifically for Android in a crypto plugin. However, the actual code diff is unavailable, so no direct evidence can be reviewed. Based only on the title and message, it appears to be a platform-specific build or compatibility fix rather than a security vulnerability.
Security candidatefeat: Epic slatepacks and uiby sneurlax · f30030a8 · Jan 12, 2026 · 20 filesMessage 57 · ThinInformational 15Details
Commit message · sneurlax
feat: Epic slatepacks and ui
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100
This commit adds a new user-facing feature to Stack Wallet: support for Epic Cash 'slatepack' transactions. Slatepacks are a manual, offline-friendly way to exchange transaction data (via QR codes, text, or files) as an alternative to the automatic 'Epicbox' method. The change introduces new UI screens, models, and wallet methods to create, receive, decode, and finalize slatepacks. There is no indication in the commit that this is a security fix or vulnerability patch.
AI review queuedsatisfy linter and some clean upby julian · 9f92bcbe · Jan 12, 2026 · 3 filesMessage 45 · ThinInformational 12Details
Commit message · julian
satisfy linter and some clean up
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100
This commit is a routine code cleanup and linter-compliance patch for the Stack Wallet Firo/Spark wallet code. It removes unused imports, renames a variable for clarity, refactors a small helper function, updates comments, and bumps a dependency (coinlib) to a newer commit. There is no direct evidence in the diff of a security vulnerability being fixed or introduced.
AI review queuedAdd support for creating Firo masternodes.by cassandras-lies · 65a8596a · Jan 12, 2026 · 11 filesMessage 45 · ThinLow 34Details
Commit message · cassandras-lies
Add support for creating Firo masternodes.
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 34/100
This commit adds a new feature to Stack Wallet that lets Firo cryptocurrency users create and manage masternodes directly from the app. A masternode is a special server that helps run the Firo network and requires locking up 1,000 FIRO as collateral. The change adds new screens, wallet logic, and transaction-building code to support this. It is a feature-add commit, not a stated security fix, but it touches sensitive areas like transaction construction, address validation, and balance checks.
Lower-priorityupdate coinlib with firo related changeby julian · 2857755f · Jan 12, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · julian
update coinlib with firo related change
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-prioritywrap xelis lib model to fix conditional importby julian · 4b9606eb · Jan 12, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · julian
wrap xelis lib model to fix conditional import
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds pagination to the desktop transaction history view in Stack Wallet. It introduces a reusable paginated list widget and refactors the transaction list to use it, grouping CashFusion transactions and switching from unstable unique widget keys to stable keys based on transaction IDs. There is no security-relevant change visible in the diff.
Lower-priorityadd tooltip option to app bar icon buttonby julian · 964d2dd1 · Jan 12, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · julian
add tooltip option to app bar icon button
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 35/100
This commit changes how Stack Wallet manages background listeners for Epic Cash wallets. Previously, a single global listener was stopped and restarted during every wallet refresh, which could cause unnecessary reconnections and possibly interfere with other wallets' listeners in multi-wallet setups. The update makes listeners per-wallet, only stops the listener when there are actually new blocks to scan, and checks whether the listener is still alive before restarting it. The main security-relevant concern is that the old behavior may have left wallets briefly without a listener or restarted listeners unnecessarily, potentially causing missed transaction notifications or race conditions; the new behavior is a hardening improvement rather than an active vulnerability fix.
AI review queuedfiro restore and refresh optimizationsby julian · e5bbd328 · Jan 8, 2026 · 4 filesMessage 45 · ThinInformational 17Details
Commit message · julian
firo restore and refresh optimizations
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100
This commit is a performance optimization for the Firo wallet in Stack Wallet. It replaces many individual ElectrumX server lookups with batched requests when restoring or refreshing a wallet, and it removes some redundant confirmation checks. The changes are mostly about speed and efficiency, not about fixing a security vulnerability. There is one small behavior change: the code now assumes any transaction already recorded with a block height is confirmed, instead of double-checking it every refresh. That is a reasonable optimization for Firo but could theoretically miss a rare blockchain reorganization. No exploit or backdoor is visible in the diff.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityfix: use rust 1.89.0 for xelisby sneurlax · 4b001669 · Jan 7, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · sneurlax
fix: use rust 1.89.0 for xelis
it works for frostdart etc as well
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfix: add wizswap to windows prebuild.ps1by sneurlax · c13778ea · Jan 7, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · sneurlax
fix: add wizswap to windows prebuild.ps1
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfix: use rust 1.85.1 for mwc, 1.89.0 for epic v4by sneurlax · c8b10514 · Jan 7, 2026 · 6 filesMessage 57 · ThinTriage 0Details
Commit message · sneurlax
fix: use rust 1.85.1 for mwc, 1.89.0 for epic v4
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefix: flutter_libepiccash apple fixes for epic v4by sneurlax · 2f85d62c · Jan 7, 2026 · 1 fileMessage 57 · ThinInformational 3Details
Commit message · sneurlax
fix: flutter_libepiccash apple fixes for epic v4
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 3/100
This commit is described as a one-line Apple-platform build fix for the Epic Cash cryptocurrency plugin. No diff is available, and the title/message do not mention any security issue, vulnerability, or user-facing bug. There is no evidence this change affects security.
Security candidatefix: apple flutter_libepiccash fixes and dev QoL changesby sneurlax · 92b96c43 · Jan 6, 2026 · 1 fileMessage 62 · AdequateInformational 0Details
Commit message · sneurlax
fix: apple flutter_libepiccash fixes and dev QoL changes
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 0/100
The commit title mentions Apple-related fixes and developer quality-of-life changes for a cryptocurrency plugin called flutter_libepiccash, but the actual code diff was not provided. Without seeing what changed, no security judgment can be made.
AI review queuedquick and dirty wizardswap integrationby julian · 71500159 · Jan 6, 2026 · 13 filesMessage 45 · ThinInformational 15Details
Commit message · julian
quick and dirty wizardswap integration
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds a new third-party exchange integration called WizardSwap to the Stack Wallet app. The changes are almost entirely normal product code: a new API client, exchange logic, UI widgets, and an SVG logo. The supplied diff does not show any obvious security bug, malicious behavior, or unsafe coding pattern. It is a feature commit, not a security patch or vulnerability disclosure.
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 4/100
This commit only updates a reference (likely a Git submodule pointer) to a dependency called flutter_libepiccash. No actual code changes are shown, and there is no description of any security fix or bug fix. On its own, this commit does not demonstrate any security issue.
AI review queuednanswap trade model fixby julian · 13ff0ca7 · Jan 6, 2026 · 1 fileMessage 28 · OpaqueLow 29Details
Commit message · julian
nanswap trade model fix
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 29/100
This commit fixes a small but meaningful bug in the Nanswap cryptocurrency exchange integration. A trade object was being created with the wrong 'direction' field—it was accidentally copying the 'rateType' value instead of the actual trade direction. This could cause trade records to show incorrect buy/sell direction, potentially confusing users or downstream trade tracking. The rest of the change is just code formatting.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritydocs: clarify that windows instructions in linux section are for wsl2by sneurlax · d85aca80 · Jan 4, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · sneurlax
docs: clarify that windows instructions in linux section are for wsl2
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body