Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
51/100 average clarity
33Strong · 80–100
316Adequate · 60–79
513Thin · 40–59
191Opaque · 0–39
33security candidates with opaque commit messaging
This commit fixes a mobile UI bug where pressing Cancel on a 'building transaction' dialog accidentally closed one too many screens. The fix moves the responsibility for closing the dialog into each screen's cancel handler, and prevents er…
No security-relevant signals in the diffUI-only navigation and error-dialog suppression changesNo cryptographic, authentication, authorization, or data-handling changes
This commit is a routine merge from the project's staging branch into a feature branch. The visible code changes fix small UI/UX bugs in Stack Wallet's send screens: clearing an internal address-validation cache when the form is reset, mak…
Clearing stale address-provider state on form reset reduces the risk of stale validation data influencing a subsequent transactionFee-form caching prevents repeated network calls and accidental fee UI flicker/state races on rebuildQR scan buttons are UX additions with no visible parser/validation logic changes
This commit fixes a desktop wallet bug where the send-fee form would repeatedly re-fetch fee estimates on every screen rebuild, wasting resources and possibly flickering. It now caches the fee estimate and only retries if the previous fetc…
No security-relevant signals present in diff or commit metadataChange is a UI/UX performance and reliability improvement
This commit merges a feature branch into another work-in-progress branch. It adds QR-code scanning buttons to two desktop token send screens and resets an internal address-validation state variable when the send form is cleared. There is n…
State reset added to clearForm() to avoid stale validation dataNew QR scan entry points in token send flows (UI feature, not a vulnerability signal)
This change fixes a UI state bug in the cryptocurrency wallet's send form. When a user clears the send form, the app now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing…
UI state desynchronization between form field and validity indicatorPotential user confusion from stale valid-address stateNo input validation, cryptographic, or network-layer changes
This commit adds a QR code scanner button to two desktop cryptocurrency send forms. It is a straightforward user-interface feature addition with no apparent security relevance.
This commit adds a missing QR code scan button to two desktop token send screens in the Stack Wallet app. It is a straightforward user-interface fix that restores a feature already present on mobile and other send views; there is no indica…
This commit is purely a code-formatting cleanup. It changes line breaks and indentation in four user-interface files so the code is easier to read, but it does not change what the app actually does. There is no security relevance.
This commit fixes a UI bug in the desktop version of Stack Wallet where the send amount could be lost while the app was trying to estimate transaction fees. The fix keeps the amount 'alive' in memory so fee estimation does not accidentally…
State lifecycle issue in UI provider could lead to loss of user inputFix prevents fee estimation from silently resetting send amount to zeroNo cryptographic, authentication, or network security changes present
This commit updates the Stack Wallet app so that when a single payment is broken into multiple cryptocurrency transactions, the user sees a clear warning on the confirmation screen. It also changes the app's internal record-keeping to hand…
UI now warns users when a payment will be split into multiple on-chain transactionsInternal transaction model changed from single txid to list of txidsMultiple confirmation flows updated to iterate over all txids for notes and trade lookups
This commit fixes a performance bug in the desktop version of Stack Wallet where the app repeatedly re-fetched Bitcoin-style fee rates every time the on-screen fee form rebuilt. The change caches the fee result and only fetches again if th…
Unnecessary repeated network requests reducedFuture result cached to avoid re-execution on widget rebuildError path clears cache to allow retry
This commit fixes a UI state bug in Stack Wallet's send form. When a user clears the send form, the wallet now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing an old ad…
Stale UI state after form resetAddress validity not synchronized with address field resetPotential UI confusion leading to incorrect send confirmation
This is a large feature/fix merge that restores and rewrites the Xelis (XEL) cryptocurrency integration in Stack Wallet. It swaps the old hand-rolled Xelis code for a new generated native interface (XWF), adds wallet restore/backup support…
Send-flow lifecycle hardening: prepared Xelis transactions are now discarded via cancelSend when the user cancels or the widget is disposedSession-generation checks prevent stale wallet handles from being used after close/reopenMutex serialization added around send preparation, balance, history, and rescan operations
This commit is a large merge that mainly adds integration tests for a desktop 'forgot password' reset feature and makes supporting code changes to safely shut down background database workers during that reset. It also removes a large set …
New integration tests exercise a destructive 'forgot password' data-wipe featureTests assert that password store and wallet key store are deleted on successful resetTests assert that wallet files are deleted while backup and tor state are preserved
This commit lets users type multi-line notes when editing transaction and trade notes, and fixes the desktop layout so long notes scroll instead of breaking the screen. It also swaps the old `mounted` check for the newer `context.mounted` …
This commit is a large merge that mainly removes old integration tests and adds new desktop 'forgot password' reset tests. It also adds a safe-shutdown path for background Firo cache workers and databases. The changes look like defensive h…
Added safe shutdown of Firo cache isolates/SQLite databases before reset exitNew integration tests verify desktop forgot-password reset deletes secrets and preserves backupsTest harness intercepts exit() and IOOverrides to observe reset side effects
This commit fixes the desktop "forgot password" reset flow in Stack Wallet. It adds integration tests that verify the app can securely wipe its own data when a user forgets the desktop password, and it updates the Firo cache worker to clos…
Desktop password reset now closes Firo cache workers and SQLite databases before deleting app data, reducing the risk of data leakage or corruption during wipeNew integration tests assert that a successful reset removes password store (hive/desktopdata.hive), wallet key store (isar/desktopStore.isar), and wallet files while preserving backups and tor stateFailed reset scenario leaves a .reset-pending marker and removes password/key stores first, preventing the reset from being undone after partial deletion
This commit is a large merge that mainly adds a new 'prove you own a Spark address' feature to the Stack Wallet app, plus some related fixes. It also updates a dependency that handles SOCKS5 proxy connections and changes how the app decide…
New cryptographic signing path added: SparkInterface.signMessage now delegates to Spark ownership proof creation using the wallet's private key and spark derivation path.Ownership proof code rejects view-only wallets and blank messages, and searches a 100-address lookahead for the requested address before signing.Dependency upgrade: socks5_proxy 1.0.3+dev.3 -> 2.1.1, which may change SOCKS5/Tor proxy behavior; a new test verifies hostname/onion routing through a fake SOCKS server.
This commit adds a new feature to Stack Wallet that lets users prove they own a Spark (privacy) address by generating a cryptographic ownership proof. It also improves the sign/verify screens so view-only wallets can still verify proofs, a…
New cryptographic proof generation using private key material (privateKeyHex, spendKeyIndex, diversifier) inside an isolateView-only wallet guard added for proof creation (throws if isViewOnly)Message whitespace now preserved for pasted/typed challenge messages, preventing proof/verification mismatches caused by silent trimming
This commit merges several changes into a development branch. The most notable security-relevant change is a fix for how the Trocador exchange service routes traffic: it now automatically uses Tor (an anonymity network) when the user has T…
Trocador exchange API previously forced clearnet (`isOnion: false`) at every call site, bypassing Tor even when enabledNew `_useTor` getter centralizes Tor routing decision based on app feature flag and user preferenceOnion service address rotated to a new v3 .onion hostname
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI review queuedfeat(spl): add Solana token (SPL) state mgmt providersby sneurlax · 70b7f51f · Oct 31, 2025 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax
feat(spl): add Solana token (SPL) state mgmt providers
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds two new Dart files that manage UI state for Solana token wallets. One tracks which token wallet is currently active, and the other returns a hard-coded mock balance of 1000.00 for development purposes. There is no security-sensitive code, no cryptographic handling, no network calls, and no user data processing. It is a routine feature addition with no apparent security relevance.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds a new placeholder/mock implementation of a Solana token wallet for user-interface development. The code is explicitly labeled as a mock, contains only stub methods, and does not perform real transactions, balance lookups, or fee handling. There is no indication of a security flaw in the added code.
AI review queuedstandalone mwebd for windowsby Julian · 30730b89 · Oct 31, 2025 · 14 filesMessage 35 · OpaqueLow 35Details
Commit message · Julian
standalone mwebd for windows
35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Low 35/100
This commit changes how the Stack Wallet app handles a helper program called mwebd on Windows. Instead of using a built-in library, it now extracts a separate mwebd.exe file from the app bundle, writes it to disk, checks its SHA256 hash, and runs it as a standalone process. The change also updates build instructions and dependency versions. There is no claim in the commit that this fixes a security issue, but the new code introduces a few security-relevant patterns worth reviewing: it executes a bundled binary, relies on a compile-time hash check, and uses a dynamic object wrapper to hide platform-specific server types.
Lower-priorityensure if a certain app coin is not found that the price call still works for the othersby Julian · 3bc921f8 · Oct 31, 2025 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Julian
ensure if a certain app coin is not found that the price call still works for the others
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityfix(win/linux): mwc var in cmake templatesby Julian · 1a30f6fe · Oct 30, 2025 · 2 filesMessage 57 · ThinTriage 0Details
Commit message · Julian
fix(win/linux): mwc var in cmake templates
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
AI review queuedfix: mwc list positionby Julian · 28cacaab · Oct 30, 2025 · 1 fileMessage 40 · ThinInformational 15Details
Commit message · Julian
fix: mwc list position
40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit simply moves one line in a configuration script so that a cryptocurrency called Mimblewimblecoin appears in a different position within an internal list. There is no security-relevant change visible in the diff.
AI review queuedprevent opening of already opened xmr/wow/sal walletsby Julian · 076fd922 · Oct 29, 2025 · 9 filesMessage 50 · ThinLow 42Details
Commit message · Julian
prevent opening of already opened xmr/wow/sal wallets
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 42/100
This commit changes how Stack Wallet initializes Monero-style (XMR, WOW, SAL) wallets. During setup, it now briefly opens the wallet, updates network node settings, immediately closes it, and clears the reference. The stated goal is to avoid leaving wallets open when they are already opened elsewhere. The change is defensive and cleanup-oriented rather than a clear fix for an active attack.
AI review queuedfix linux wow headerby Julian · 3e137fde · Oct 29, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Julian
fix linux wow header
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit updates a single commented-out dependency version in a template file used to configure the Linux build. It is a routine version bump for an optional Wownero cryptocurrency library and contains no active code changes or security fixes.
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive path
AI analysis · Informational 10/100
This commit updates a single dependency version number for a Wownero-related Flutter library from 2.0.0 to 2.0.2 in a template file. There is no indication in the commit itself that this fixes a security vulnerability. It appears to be a routine dependency bump.
Security candidateWIP extract some kind of CryptonoteWallet interfaceby Julian · 025404b6 · Oct 28, 2025 · 26 filesMessage 30 · OpaqueInformational 18Details
Commit message · Julian
WIP extract some kind of CryptonoteWallet interface
30/100 · OpaqueMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body! Contains work-in-progress language! Opaque security-relevant change
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 18/100
This commit is a work-in-progress code cleanup that introduces a shared 'CryptonoteWallet' interface for Monero-like wallets (Monero, Wownero, Salvium). It replaces repeated checks for individual wallet classes with checks against the new shared interface. There is no direct security fix here; it is a refactoring change that could slightly reduce future bugs by making the code more consistent, but it also changes behavior in a few places by broadening which wallets match certain conditions.
separated xmw and wow libs. Dirty dirty minimal get-it-running mess
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Low 28/100
This commit is a large refactor that splits the Wownero (WOW) cryptocurrency support out of the shared Monero (XMR) library path and into its own dedicated library (cs_wownero). It updates wallet creation, address validation, fee estimation, and restore logic to use the new Wownero-specific code instead of the old combined Monero/Wownero code. The commit message calls it a 'dirty dirty minimal get-it-running mess,' suggesting it is a rough, temporary implementation rather than a polished security fix.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 2/100
This commit updates two internal cryptocurrency plugin libraries (flutter_libepiccash and flutter_libmwc) for compatibility with iOS 26. No code diff is available, and the commit message gives no indication of a security fix. It appears to be a routine platform-compatibility dependency bump.
AI review queuedupdate mwebd libby Julian · bed9d1b8 · Oct 27, 2025 · 2 filesMessage 28 · OpaqueLow 25Details
Commit message · Julian
update mwebd lib
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 25/100
This commit simply bumps the version of a third-party library called flutter_mwebd from an early pre-release version (0.0.1-pre.8) to a slightly newer pre-release version (0.0.1-pre.10). The change appears in dependency lock files only. There is no description of why the update was made, no mention of security fixes, and no diff showing what actually changed inside the library. On its own, this commit does not show a vulnerability, but updating a pre-release library can sometimes include bug or security fixes.
Lower-priorityRemove unused isar_build script function.by Dan Miller · f26e2e87 · Oct 27, 2025 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Dan Miller
Remove unused isar_build script function.
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 2/100
This commit only updates three submodule pointers (flutter_libepiccash, flutter_libmwc, frostdart) with a message saying they contain 'macos framework fixes'. No actual code changes or diff content are available, and no verified references describe what those submodule fixes do. There is no direct evidence this is a security patch.
Lower-priorityAdd optional flag to build Isar from source.by Dan Miller · 5dc68143 · Oct 27, 2025 · 4 filesMessage 45 · ThinTriage 0Details
Commit message · Dan Miller
Add optional flag to build Isar from source.
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedensure tor singletonby Julian · 2299b45d · Oct 25, 2025 · 1 fileMessage 28 · OpaqueLow 27Details
Commit message · Julian
ensure tor singleton
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 27/100
This commit changes the Tor privacy service in Stack Wallet so that only one instance of the service is created and reused, rather than creating a fresh one each time. This is a code-quality and reliability fix. It does not by itself fix a known exploit, but running multiple Tor service instances could previously have caused inconsistent privacy states, resource waste, or subtle bugs that might weaken privacy guarantees.
AI review queuedensure tor singletonby julian · ff9e8f0b · Oct 25, 2025 · 1 fileMessage 28 · OpaqueLow 28Details
Commit message · julian
ensure tor singleton
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 28/100
This commit changes the Tor privacy service in Stack Wallet so only one copy of the service can run at a time (a 'singleton'). Before, each call could create a fresh instance, which could lead to multiple Tor connections or inconsistent state. The patch itself is a defensive code-quality fix; it does not show an active attack or known breach.
AI review queueddart autoformatby julian · cb198ed5 · Oct 24, 2025 · 1 fileMessage 18 · OpaqueInformational 15Details
Commit message · julian
dart autoformat
18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is purely a code formatting change (Dart autoformat) on a single file. It only adjusts whitespace, line breaks, and indentation without changing any logic, variable names, function calls, or behavior. There is no security relevance.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body! Contains work-in-progress language! Opaque security-relevant change
Why it was queued
seed or entropy path
AI analysis · Informational 15/100
This commit adds a new utility module for handling Electrum-style cryptocurrency seed phrases, plus tests. It does not fix any bug or change existing behavior; it is a work-in-progress feature addition. There is nothing in the commit that suggests a security vulnerability or a security patch.
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathmerge-commit duplicate discount
AI analysis · Informational 15/100
This is a large routine release merge for Stack Wallet v2.4.0. It adds thousands of project files including source code, assets, build scripts, tests, and GitHub workflow files. There is no specific security fix or vulnerability patch visible in the supplied portion of the diff, and no security-relevant description from the vendor.
Security candidateMerge branch 'main' into stagingby Dan Miller · b97aad30 · Oct 24, 2025 · 1981 filesMessage 45 · ThinInformational 15Details
Commit message · Dan Miller
Merge branch 'main' into staging
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathmerge-commit duplicate discount
AI analysis · Informational 15/100
This commit is a large merge from the 'main' branch into 'staging' for the Stack Wallet project. It adds many files including project configuration, assets, source code, tests, and documentation. There is no indication in the commit message or visible changes that this is a security fix or introduces a security vulnerability. It appears to be a routine synchronization of branches.