SW
← All projectsStack Wallet

Stack Wallet

Actively maintained multi-coin self-custody wallet with Monero support and on-device keys.

MoneroPrivacy protocolsSoftware walletsNormal
Repository coverage

1053 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

338security candidates411second-pass queue749AI analyses
81commits · 30 days
175commits · 60 days
600commits · 180 days
1008commits · 365 days
Backfill bands
Sep 27 → Mar 31404 seen73 candidatesComplete
Mar 31 → Jul 29463 seen238 candidatesComplete
Jul 29 → Aug 2887 seen8 candidatesComplete
Aug 28 → Sep 2753 seen6 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

51/100 average clarity
33Strong · 80–100
316Adequate · 60–79
513Thin · 40–59
191Opaque · 0–39
33security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Navid Rahimi1017154
sneurlax339158241062
julian347112269044
Julian19741144043
Dan Miller831525053
Reuben Yap20318052
Cyrix12615211049
julian-CStack222049
levoncrypto24121043
Tritonn204412052
cassandras-lies413048
NyanCatTW1111045
Analysis record

Published AI watches

Last scanned 53 minutes ago

Informational 24 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1469 from Cyrix126/building_dialog_cancel

This commit fixes a mobile UI bug where pressing Cancel on a 'building transaction' dialog accidentally closed one too many screens. The fix moves the responsibility for closing the dialog into each screen's cancel handler, and prevents er…

No security-relevant signals in the diffUI-only navigation and error-dialog suppression changesNo cryptographic, authentication, authorization, or data-handling changes
94e6da66by Julian+68−8412 files
No security note in commit
Informational 20 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into building_dialog_cancel

This commit is a routine merge from the project's staging branch into a feature branch. The visible code changes fix small UI/UX bugs in Stack Wallet's send screens: clearing an internal address-validation cache when the form is reset, mak…

Clearing stale address-provider state on form reset reduces the risk of stale validation data influencing a subsequent transactionFee-form caching prevents repeated network calls and accidental fee UI flicker/state races on rebuildQR scan buttons are UX additions with no visible parser/validation logic changes
0485b166by Julian+194−56 files
No security note in commit
Informational 17 AI analysisMessage 58 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1468 from Cyrix126/desktop_fee_form_refetch

This commit fixes a desktop wallet bug where the send-fee form would repeatedly re-fetch fee estimates on every screen rebuild, wasting resources and possibly flickering. It now caches the fee estimate and only retries if the previous fetc…

No security-relevant signals present in diff or commit metadataChange is a UI/UX performance and reliability improvement
62432946by Julian+176−52 files
No security note in commit
Informational 17 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into desktop_fee_form_refetch

This commit merges a feature branch into another work-in-progress branch. It adds QR-code scanning buttons to two desktop token send screens and resets an internal address-validation state variable when the send form is cleared. There is n…

State reset added to clearForm() to avoid stale validation dataNew QR scan entry points in token send flows (UI feature, not a vulnerability signal)
8a72c82fby Julian+18−04 files
No security note in commit
Low 32 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1467 from Cyrix126/clear_send_form_validity

This change fixes a UI state bug in the cryptocurrency wallet's send form. When a user clears the send form, the app now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing…

UI state desynchronization between form field and validity indicatorPotential user confusion from stale valid-address stateNo input validation, cryptographic, or network-layer changes
d3383b4eby Julian+2−02 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into clear_send_form_validity

This commit adds a QR code scanner button to two desktop cryptocurrency send forms. It is a straightforward user-interface feature addition with no apparent security relevance.

22560a59by Julian+16−02 files
No security note in commit
Informational 20 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1466 from Cyrix126/desktop_token_qr_button

This commit adds a missing QR code scan button to two desktop token send screens in the Stack Wallet app. It is a straightforward user-interface fix that restores a feature already present on mobile and other send views; there is no indica…

47f6d369by Julian+16−02 files
No security note in commit
Informational 15 AI analysisMessage 18 · Opaque
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

style: format

This commit is purely a code-formatting cleanup. It changes line breaks and indentation in four user-interface files so the code is easier to read, but it does not change what the app actually does. There is no security relevance.

ae45aba8by Cyrix126+47−524 files
No security note in commit
Informational 23 AI analysisMessage 62 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

fix: stop estimating the desktop fee for a zero amount

This commit fixes a UI bug in the desktop version of Stack Wallet where the send amount could be lost while the app was trying to estimate transaction fees. The fix keeps the amount 'alive' in memory so fee estimation does not accidentally…

State lifecycle issue in UI provider could lead to loss of user inputFix prevents fee estimation from silently resetting send amount to zeroNo cryptographic, authentication, or network security changes present
90c91bdeby Cyrix126+22−02 files
No security note in commit
Low 32 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

show split tx warning on confirm screen

This commit updates the Stack Wallet app so that when a single payment is broken into multiple cryptocurrency transactions, the user sees a clear warning on the confirmation screen. It also changes the app's internal record-keeping to hand…

UI now warns users when a payment will be split into multiple on-chain transactionsInternal transaction model changed from single txid to list of txidsMultiple confirmation flows updated to iterate over all txids for notes and trade lookups
80343a5aby Julian+376−23916 files
No security note in commit
Informational 18 AI analysisMessage 62 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

fix: stop refetching the desktop fee rates on every rebuild

This commit fixes a performance bug in the desktop version of Stack Wallet where the app repeatedly re-fetched Bitcoin-style fee rates every time the on-screen fee form rebuilt. The change caches the fee result and only fetches again if th…

Unnecessary repeated network requests reducedFuture result cached to avoid re-execution on widget rebuildError path clears cache to allow retry
a1ca9292by Cyrix126+154−52 files
No security note in commit
Low 34 AI analysisMessage 62 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

fix: reset the address validity when clearing the send form

This commit fixes a UI state bug in Stack Wallet's send form. When a user clears the send form, the wallet now also resets whether the entered address is considered valid. Without this fix, the form could incorrectly keep showing an old ad…

Stale UI state after form resetAddress validity not synchronized with address field resetPotential UI confusion leading to incorrect send confirmation
43dd0477by Cyrix126+2−02 files
No security note in commit
Low 35 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1450 from Ez3kiel-dev/fix/xelis-integration

This is a large feature/fix merge that restores and rewrites the Xelis (XEL) cryptocurrency integration in Stack Wallet. It swaps the old hand-rolled Xelis code for a new generated native interface (XWF), adds wallet restore/backup support…

Send-flow lifecycle hardening: prepared Xelis transactions are now discarded via cancelSend when the user cancels or the widget is disposedSession-generation checks prevent stale wallet handles from being used after close/reopenMutex serialization added around send preparation, balance, history, and rescan operations
ad945d43by Julian+4298−162634 files
No security note in commit
Low 32 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into fix/xelis-integration

This commit is a large merge that mainly adds integration tests for a desktop 'forgot password' reset feature and makes supporting code changes to safely shut down background database workers during that reset. It also removes a large set …

New integration tests exercise a destructive 'forgot password' data-wipe featureTests assert that password store and wallet key store are deleted on successful resetTests assert that wallet files are deleted while backup and tor state are preserved
b0e5d35aby Julian+2678−330378 files
No security note in commit
Informational 19 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1361 from cypherstack/fix/305-multiline-transaction-notes

This commit lets users type multi-line notes when editing transaction and trade notes, and fixes the desktop layout so long notes scroll instead of breaking the screen. It also swaps the old `mounted` check for the newer `context.mounted` …

5172e63eby Julian+402−1113 files
No security note in commit
Low 32 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into fix/305-multiline-transaction-notes

This commit is a large merge that mainly removes old integration tests and adds new desktop 'forgot password' reset tests. It also adds a safe-shutdown path for background Firo cache workers and databases. The changes look like defensive h…

Added safe shutdown of Firo cache isolates/SQLite databases before reset exitNew integration tests verify desktop forgot-password reset deletes secrets and preserves backupsTest harness intercepts exit() and IOOverrides to observe reset side effects
21491edbby Julian+2352−319075 files
No security note in commit
Moderate 57 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1455 from cypherstack/fix/desktop-pw-reset

This commit fixes the desktop "forgot password" reset flow in Stack Wallet. It adds integration tests that verify the app can securely wipe its own data when a user forgets the desktop password, and it updates the Firo cache worker to clos…

Desktop password reset now closes Firo cache workers and SQLite databases before deleting app data, reducing the risk of data leakage or corruption during wipeNew integration tests assert that a successful reset removes password store (hive/desktopdata.hive), wallet key store (isar/desktopStore.isar), and wallet files while preserving backups and tor stateFailed reset scenario leaves a .reset-pending marker and removes password/key stores first, preventing the reset from being undone after partial deletion
055e6c6bby Julian+1077−297154 files
No security note in commit
Low 37 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into fix/desktop-pw-reset

This commit is a large merge that mainly adds a new 'prove you own a Spark address' feature to the Stack Wallet app, plus some related fixes. It also updates a dependency that handles SOCKS5 proxy connections and changes how the app decide…

New cryptographic signing path added: SparkInterface.signMessage now delegates to Spark ownership proof creation using the wallet's private key and spark derivation path.Ownership proof code rejects view-only wallets and blank messages, and searches a 100-address lookahead for the requested address before signing.Dependency upgrade: socks5_proxy 1.0.3+dev.3 -> 2.1.1, which may change SOCKS5/Tor proxy behavior; a new test verifies hostname/onion routing through a fake SOCKS server.
d9b5cc02by Julian+1275−21923 files
No security note in commit
Low 34 AI analysisMessage 83 · Strong
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1439 from navidR/dev/navidr/spark-name-verification

This commit adds a new feature to Stack Wallet that lets users prove they own a Spark (privacy) address by generating a cryptographic ownership proof. It also improves the sign/verify screens so view-only wallets can still verify proofs, a…

New cryptographic proof generation using private key material (privateKeyHex, spendKeyIndex, diversifier) inside an isolateView-only wallet guard added for proof creation (throws if isViewOnly)Message whitespace now preserved for pasted/typed challenge messages, preventing proof/verification mismatches caused by silent trimming
a5411a50by Julian+1097−16616 files
No security note in commit
Low 39 AI analysisMessage 60 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge branch 'staging' into dev/navidr/spark-name-verification

This commit merges several changes into a development branch. The most notable security-relevant change is a fix for how the Trocador exchange service routes traffic: it now automatically uses Tor (an anonymity network) when the user has T…

Trocador exchange API previously forced clearnet (`isOnion: false`) at every call site, bypassing Tor even when enabledNew `_useTor` getter centralizes Tor routing decision based on app feature flag and user preferenceOnion service address rotated to a new v3 .onion hostname
92955848by Julian+122−507 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidatefeat(shopinbit): add Resume card with live/expired routingby sneurlax · 14dfe846 · Apr 14, 2026 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

feat(shopinbit): add Resume card with live/expired routing

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit adds a new 'Resume' card to the ShopInBit tickets screen. It lets a user continue paying for an unfinished car-research order if the invoice is still live, or restart the fee step if the invoice has expired. There is no security-relevant change visible in the diff.

Security candidatefeat(shopinbit): add Isar fields for car research retryby sneurlax · a4209634 · Apr 14, 2026 · 4 filesMessage 62 · AdequateInformational 18Details
Commit message · sneurlax

feat(shopinbit): add Isar fields for car research retry

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 18/100

This commit adds three new data fields to the app's local database to support a 'car research retry' feature for ShopInBit tickets. It also makes the app clear the ticket table if the database schema no longer matches, and makes ticket listing silently return an empty list on errors. There is no obvious security bug, but the broad error catching could hide unrelated database problems from users.

AI review queuedfeat(cakepay): add CakePay mobile and desktop UI pagesby sneurlax · d0fe9913 · Apr 10, 2026 · 8 filesMessage 85 · StrongInformational 24Details
Commit message · sneurlax

feat(cakepay): add CakePay mobile and desktop UI pages



fix: CakePay confirm send. show success flush bar after payment


fix: CakePay orders list. fetch orders by locally-stored IDs


fix: CakePay vendors view. show error message on load failure


fix: dedup countries in list

"US" and "United States" sharing the same key was throwing

feat: CakePay card detail. email field, error dialog, card info sections


feat: CakePay send-from view. filter wallets by coin


feat: CakePay order view. multi-coin payment options, countdown timer

feat: and terms and conditions text link to onboarding process

feat: handle terminal CakePay order states

feat: add info to terminal-state orders

it looked a little bare just saying 'paid'. we dont get giftcard codes and there isn't a status page etc. to show users so this is all they get. maybe we should make them confirm their email with a second input...

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 24/100

This commit adds new user-interface screens for buying gift cards through a third-party service called CakePay inside the Stack Wallet app. It lets users browse cards, enter an email, agree to terms, create an order, choose a cryptocurrency to pay with, and send the payment from one of their wallets. The changes are mostly UI wiring; they do not obviously fix or introduce a security vulnerability on their own, but they do handle money, email addresses, and external web links, so the implementation quality matters.

Security candidatefix(shopinbit): make desktop ShopinBit settings scrollable and remove dividersby sneurlax · 9a304e4c · Apr 10, 2026 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

fix(shopinbit): make desktop ShopinBit settings scrollable and remove dividers

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit is a minor user-interface fix for the desktop ShopinBit settings page. It wraps the settings content in a scrollable view so it fits on smaller screens and replaces visual divider lines with simple spacing. There is no security relevance.

Security candidatefix(shopinbit): remove travel delivery country, pre-fill display name, add name settingby sneurlax · a488cb07 · Apr 10, 2026 · 5 filesMessage 62 · AdequateInformational 12Details
Commit message · sneurlax

fix(shopinbit): remove travel delivery country, pre-fill display name, add name setting

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 12/100

This commit updates the Stack Wallet app's ShopinBit integration. It removes the 'delivery country' field for travel purchases, pre-fills the user's display name from saved settings, and adds a new settings page option to edit that display name. There is no clear security fix here; it appears to be a routine feature/UX update.

Security candidatefix(shopinbit): don't pass non-ASCII chars in countryLabelsby sneurlax · 3baaf0d3 · Apr 10, 2026 · 1 fileMessage 62 · AdequateLow 37Details
Commit message · sneurlax

fix(shopinbit): don't pass non-ASCII chars in countryLabels

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 37/100

This commit fixes a bug in Stack Wallet's ShopInBit feature where country names containing special characters (like 'Åland Islands') were being corrupted when sent to a server. The fix replaces the full country name with the two-letter ISO country code in the request description, preventing the corruption. This is a data-integrity bug rather than a traditional security vulnerability, but it could cause orders to be submitted with unreadable or incorrect destination country information.

Security candidatefeat(shopinbit): travel booking form and late fixesby sneurlax · 6c0015fe · Apr 10, 2026 · 3 filesMessage 62 · AdequateInformational 20Details
Commit message · sneurlax

feat(shopinbit): travel booking form and late fixes

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 20/100

This commit adds a new travel-booking form to the Stack Wallet app's ShopinBit feature and makes a few small UI and business-rule tweaks. It is a routine feature patch: it does not fix a security vulnerability, introduce obvious malicious behavior, or change cryptography or authentication code. The only notable change is that the fallback fee shown to users for a car-research payment was raised from 50.00 EUR to 223.00 EUR, which is a product/business decision rather than a security issue.

Security candidatefeat(shopinbit): desktop branding, setup dialog, and dialog UXby sneurlax · a4253ef3 · Apr 10, 2026 · 14 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

feat(shopinbit): desktop branding, setup dialog, and dialog UX

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit is a routine user-interface update for the ShopinBit feature in Stack Wallet. It changes branding text, adds a first-time setup dialog for desktop users, improves dialog scrolling and navigation, and renames 'My tickets' to 'My requests'. There is no indication of any security fix or vulnerability being addressed.

Security candidatefix(shopinbit): coin selection payment UI and customer key 403 errorsby sneurlax · ca52f989 · Apr 10, 2026 · 5 filesMessage 62 · AdequateInformational 24Details
Commit message · sneurlax

fix(shopinbit): coin selection payment UI and customer key 403 errors

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 24/100

This commit is a routine bug-fix and UI update for the ShopInBit integration in Stack Wallet. It changes how users pick a cryptocurrency to pay with, stops the app from making API calls that fail with a '403 forbidden' error for car-research tickets, and makes sure a customer key is loaded before those API calls. There is no clear security vulnerability being fixed; the changes appear to be functional improvements and error handling.

Security candidatefeat(shopinbit): category-specific form fields in step 4by sneurlax · 8b543fac · Apr 10, 2026 · 2 filesMessage 62 · AdequateInformational 19Details
Commit message · sneurlax

feat(shopinbit): category-specific form fields in step 4

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 19/100

This commit is a routine feature update for the ShopinBit shopping integration inside Stack Wallet. It adds category-specific form fields (concierge and car-research requests), separates delivery and billing addresses, and updates the displayed research fee from €50 to €223. There is no clear security bug in the diff itself, but the large UI refactor introduces more places where user input is collected and sent to the ShopinBit backend, so input handling and backend trust should be watched.

Security candidatefeat(shopinbit): guidelines persistence, billing address, and setup viewby sneurlax · 91409149 · Apr 10, 2026 · 7 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

feat(shopinbit): guidelines persistence, billing address, and setup view

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit adds new user-facing features for the ShopinBit service inside the Stack Wallet app: a first-time setup screen that generates and displays a customer recovery key, a persistent display name, the ability to save that you've accepted service guidelines, and an optional separate billing address when entering shipping details. There is no indication in the commit that these changes fix a security bug or introduce a security vulnerability.

Security candidaterefactor(shopinbit): rename ShopInBit to ShopinBit and ticket to requestby sneurlax · 603be988 · Apr 10, 2026 · 18 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

refactor(shopinbit): rename ShopInBit to ShopinBit and ticket to request

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit is a simple rebranding and wording update for the ShopinBit feature inside the Stack Wallet app. It changes the displayed name from 'ShopInBit' to 'ShopinBit' and replaces the word 'ticket' with 'request' in user-facing labels. There are no security-relevant code changes.

Security candidatefix(shopinbit): mobile back-button handling and car research payment flowby sneurlax · dc765a39 · Apr 10, 2026 · 4 filesMessage 62 · AdequateInformational 20Details
Commit message · sneurlax

fix(shopinbit): mobile back-button handling and car research payment flow

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 20/100

This commit fixes the mobile back-button behavior and the payment flow for a car-research feature inside the Stack Wallet app. It changes how the app figures out the payment amount (reading it from a BIP21 payment URI instead of an API field that no longer exists) and adds a 'PAY NOW' button that can launch the wallet's own send screen. There is no clear security bug being patched; it looks like a routine functional fix for a partner integration.

Security candidatefeat(shopinbit): car research payment view and API integrationby sneurlax · 1663d630 · Apr 10, 2026 · 3 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

feat(shopinbit): car research payment view and API integration

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit adds a new user interface for paying a car-research fee through the ShopInBit service. It replaces a simple local placeholder with a real API integration: users pick a billing country, the app creates an invoice via the backend, shows a QR code/payment address, polls for payment status, and records the order locally once paid. There is nothing in the diff that looks like a security vulnerability.

Security candidatefeat(shopinbit): step navigation and category selection UXby sneurlax · dabd931a · Apr 10, 2026 · 3 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

feat(shopinbit): step navigation and category selection UX

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit is a routine user-experience update for the ShopInBit shopping feature. It re-enables a category-selection screen that had been skipped, resets the category choice when that screen opens, and adds a clearer placeholder message when the user is requesting a car. There is no security-relevant change.

Security candidatefix(shopinbit): various shopinbit ui fixesby sneurlax · 56c53fba · Apr 7, 2026 · 7 filesMessage 80 · StrongInformational 15Details
Commit message · sneurlax

fix(shopinbit): various shopinbit ui fixes

fix(shopinbit): resize text links

they had been adjusted to fit desktop

this fixes mobile & desktop
fix(shopinbit): country dropdown placement

it was overlapping the input
fix(shopinbit): fix checkbox alignment

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathauthentication path
AI analysis · Informational 15/100

This commit is a routine user-interface polish for the ShopinBit shopping feature. It tweaks text link font sizes, adjusts a country dropdown position so it no longer overlaps an input field, fixes checkbox alignment, and swaps a services icon from an outline to a solid version. There are no security-relevant changes.

Security candidatefix(shopinbit): fix navby sneurlax · 9f2f4478 · Apr 7, 2026 · 2 filesMessage 63 · AdequateInformational 15Details
Commit message · sneurlax

fix(shopinbit): fix nav

fix(shopinbit): PaymentView back nav to pop to tickets

and add PopScope
fix(shopinbit): OrderCreated back nav to pop to ServicesView

and add PopScope

63/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit changes where the app goes when a user taps the back button on two ShopInBit screens. Previously, the back button would simply go to the previous screen; now it jumps back to a specific starting screen (the services list or the tickets list). It also wraps the screens in a Flutter widget that prevents the system's own back gesture from doing anything other than the custom navigation. There is no security issue here—this is purely a user-experience navigation fix.

AI review queuedfix(firo): desktop/mobile ui branching for masternode registrationsby levoncrypto · 8bd64276 · Apr 7, 2026 · 3 filesMessage 62 · AdequateInformational 19Details
Commit message · levoncrypto

fix(firo): desktop/mobile ui branching for masternode registrations

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit fixes UI layout and navigation bugs in the Firo masternode registration flow for desktop and mobile. It removes an unnecessary visual wrapper on desktop, simplifies a button text style, and—most importantly—corrects the post-transaction navigation so the masternode creation screen appears properly on desktop inside a dialog and on mobile via page navigation. It also removes a special-case refresh for Firo wallets, treating all wallets the same after sending. There is no direct security vulnerability visible in the diff; it reads as a routine UI/UX bug fix.

Security candidatefeat(shopinbit): create DesktopServicesView containerby sneurlax · bbf566e7 · Apr 6, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

feat(shopinbit): create DesktopServicesView container

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit is a routine user-interface refactor for the Stack Wallet desktop app. It moves the existing ShopInBit service page into a new container so the app can show both 'Services' and 'Gift Cards' tabs. No security-sensitive logic was added or changed; the code that opens web links and starts shopping dialogs is copied unchanged into a new file.

Security candidatefix(shopinbit): ShopInBit confirm/send navigation and display fixesby sneurlax · 14d970f2 · Apr 6, 2026 · 2 filesMessage 62 · AdequateInformational 16Details
Commit message · sneurlax

fix(shopinbit): ShopInBit confirm/send navigation and display fixes

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 16/100

This commit fixes two user-interface bugs in the Stack Wallet app's ShopInBit payment flow. First, it prevents the app from crashing or showing a confusing error dialog if the user navigates away while a transaction is being broadcast. Second, it correctly displays the token symbol (for example, a stablecoin ticker) on the desktop send-confirmation screen. There is no indication these changes address a security vulnerability.

Security candidatefix(shopinbit): don't pass auth for countries endpointby sneurlax · b92a8425 · Apr 6, 2026 · 2 filesMessage 67 · AdequateLow 35Details
Commit message · sneurlax

fix(shopinbit): don't pass auth for countries endpoint

67/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 35/100

This commit changes the Stack Wallet app so that when it fetches the list of supported countries from the ShopInBit service, it no longer sends the user's authentication token with the request. It also tidies up how login credentials are formatted before being sent. The main security-relevant change is removing unnecessary authentication from a public metadata endpoint, which reduces the risk that the user's token could be leaked or logged if that endpoint is compromised or misbehaves.

Security candidatefix: remove tokenTicker param from DesktopAuthSend callby sneurlax · 038e108c · Apr 6, 2026 · 1 fileMessage 62 · AdequateInformational 16Details
Commit message · sneurlax

fix: remove tokenTicker param from DesktopAuthSend call

and use ticker symbol

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathauthentication path
AI analysis · Informational 16/100

This commit changes a desktop cryptocurrency wallet's send confirmation dialog so it can display a custom token ticker (for tokens built on a coin) instead of always showing the base coin's ticker. The title says it removes a tokenTicker parameter, but the code actually adds one. The change is mostly a UI label fix and does not appear to alter how transactions are authorized, signed, or sent.

Security candidatefix(shopinbit): fix ShopInbit USDT paymentsby sneurlax · 2b94ddc0 · Apr 6, 2026 · 3 filesMessage 57 · ThinInformational 24Details
Commit message · sneurlax

fix(shopinbit): fix ShopInbit USDT payments

and various mobile ui fixes

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 24/100

This commit fixes the ShopInBit payment feature so it can correctly pay with USDT (an Ethereum token) instead of only supporting Bitcoin and Monero. It also adds a 'check for payment' button when the user has no compatible wallet, and makes several UI labels and navigation fixes. There is no clear security vulnerability in the diff; it is a feature/bug-fix patch.

Security candidatefeat(shopinbit): add ShopInBit settings pageby sneurlax · 0f3090a3 · Apr 6, 2026 · 7 filesMessage 57 · ThinInformational 18Details
Commit message · sneurlax

feat(shopinbit): add ShopInBit settings page

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 18/100

This commit adds a new settings page for a third-party shopping feature called ShopInBit. It lets users generate, view, copy, and restore a 'customer key' used to identify them to the ShopInBit service. The change is mostly user-interface wiring and does not, on its own, appear to fix or introduce a security vulnerability. It does surface a sensitive-looking key in the UI and allows it to be copied to the system clipboard, which could matter if the key is later shown to be a secret, but the commit itself does not change how that key is stored or generated.

AI review queuedfeat(shopinbit): add ShopInBit More menu item on mobileby sneurlax · 0582da4a · Apr 6, 2026 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · sneurlax

feat(shopinbit): add ShopInBit More menu item on mobile

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply adds a new 'Services' menu item to the bottom navigation bar in the mobile wallet view. It lets users open an existing screen called ServicesView. There is no security-relevant change in the code shown.