Firmware monorepo for Trezor One, Model T, and Safe devices.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61298 seen115 candidatesCompleteFeb 6 → Jun 6775 seen58 candidatesCompleteJun 6 → Jul 6217 seen13 candidatesCompleteJul 6 → Aug 5360 seen54 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 0 minutes ago
This commit is a routine text cleanup for the Trezor hardware wallet's on-screen English messages. It fixes punctuation, removes unnecessary line breaks, and makes small wording tweaks (for example, changing 'PIN will be required' to 'A PI…
1dbc2c3cby Michal Kazda+22−422 filesThis commit adds downgrade protection for a new 'app root packet' system in Trezor firmware. Previously, the code had a TODO note saying downgrade protection needed to be considered. The change makes the device remember the timestamps of p…
4a9cf168by cepetr+335−3112 filesThis commit fixes a cryptographic edge case in Trezor's THP (Trezor Host Protocol) handshake. It now rejects Curve25519 public keys that are all zeros or that produce an all-zero shared secret. A zero public key can cause the Diffie-Hellma…
429a283dby M1nd3r+45−74 filesThis commit changes one line in a build configuration file for the Trezor hardware wallet firmware. It adds the 'ward' feature to the existing 'miniscript' feature set. There is no direct evidence in the commit that this is a security fix;…
d434a636by Jakub Janků+1−11 fileThis commit adds a new disabled-by-default feature flag called 'ward' to the Trezor firmware build system. It does not change any production firmware behavior; it only wires up a placeholder MicroPython module and build options so that fut…
7b58e75aby Jakub Janků+55−018 filesThis commit turns on a compiler warning (-Wsign-compare) that catches places where signed and unsigned numbers are compared, and fixes the resulting warnings across the Trezor firmware. Most changes are clean-up casts and loop-index type c…
1cc940a4by cepetr+162−15247 filesThis commit is a simple user-interface cleanup. It removes one duplicate translation label ('Access hidden wallet') and makes the device use a single, consistent label ('Access wallet') when asking the user to confirm opening a passphrase-…
65402aecby Michal Kazda+2−103 filesThis commit is a simple user-interface cleanup. It merges two translation labels that both meant 'Passphrase wallet' into a single label, and updates the screens that used the old duplicate label. There is no security-relevant behavior cha…
7ce6887fby Michal Kazda+5−184 filesThis commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the …
dc937ba2by tychovrahe+81−711 fileThis commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c,…
caab7d9eby tychovrahe+772−4834 filesThis commit removes an unused Rust Cargo feature flag called 'ui' from the Trezor firmware build configuration. It is a cleanup change: the feature was always enabled in practice, so the code now compiles unconditionally. There is no secur…
1436fbc6by cepetr+2−158 filesThis commit changes how users confirm an Ethereum authorization screen on Trezor's 'Caesar' layout. Previously, the user had to hold down a button to approve; now a simple tap is enough. The change only affects the user-interface interacti…
e231cc94by obrusvit+50−502 filesThis commit is a routine internal cleanup that merges two separate build packages (one for real hardware firmware and one for the desktop emulator) into a single package. It moves source files into subdirectories and updates build scripts …
6be32440by cepetr+48−32025 filesThis commit is a minor build/test maintenance change. It adds a feature flag (USE_AES_GCM) so that AES-GCM tests are only run when the feature is actually enabled in a particular firmware build. There is no security fix or vulnerability be…
890aca93by cepetr+13−14 filesThis commit only adds or updates copyright and GNU license header comments in Python test and tooling files. It makes no changes to executable code, so it cannot introduce a security vulnerability or fix one.
6dc781c2by M1nd3r+1202−203250 filesThis commit is a straightforward code cleanup: it moves the on-screen title for multisig XPUB screens from hard-coded English text into the device's translation system. The visible text remains essentially the same, and there is no securit…
6d69df16by Michal Kazda+20279−2023911 filesThis is a cosmetic code cleanup. It moves punctuation and capitalization out of the Python code and into the translation files so translated strings are shown exactly as written. There is no security-relevant change.
162ed3a2by Michal Kazda+12−125 filesThis commit simply removes two unused Rust import statements (called `use` statements). It does not change any actual code behavior, logic, or security properties of the Trezor firmware.
a56f8c3dby Roman Zeyde+0−22 filesThis commit fixes a UI formatting bug in the Tron cryptocurrency flow on Trezor hardware wallets. A missing colon was added to account information labels shown on the device screen. The change is cosmetic and does not appear to affect cryp…
739c2968by Michal Kazda+19332−193364 filesThis commit is a straightforward user-interface refactoring. It bundles an account/path label together with its corresponding value into a single tuple, instead of passing them as four separate arguments. There is no security-relevant chan…
c66f6f4dby Michal Kazda+51−7413 filesExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
148e5301 · Sep 23, 2026 · 1 fileTriage 0fix(translations) regenerated translated_strings.rs after cherrypicked fix
[no changelog]
888eb81d · Sep 23, 2026 · 1 fileTriage 0fix(translations): split English strings at byte offsets
Slice the UTF-8 bytes before decoding, so strings with multi-byte
chars (e.g. NBSP) stay one per line.
[no changelog]
996d8d63 · Sep 23, 2026 · 1 fileTriage 0test(core): adjust payment request unittests
- SELL payment requests are now supported in production.
[no changelog]
6094efe8 · Sep 22, 2026 · 3 filesTriage 0chore(core): update generated files
[no changelog]
4778a4e7 · Sep 22, 2026 · 1 fileTriage 0fix(core): allow NBSP in English strings ASCII test
[no changelog]
1dbc2c3c · Sep 22, 2026 · 2 filesInformational 15chore(core): improvements to English copy
[no changelog]
This commit is a routine text cleanup for the Trezor hardware wallet's on-screen English messages. It fixes punctuation, removes unnecessary line breaks, and makes small wording tweaks (for example, changing 'PIN will be required' to 'A PIN will be required'). There is no change to security logic, cryptography, or how the device protects funds.
bd2a538e · Sep 22, 2026 · 1 fileTriage 0fix(core/prodtest): fix signed comparison error
[no changelog]
61f7a5f0 · Sep 22, 2026 · 1 fileTriage 0build(core): deny `unused_imports` in trezor_lib
[no changelog]
05595718 · Sep 22, 2026 · 1 fileTriage 0chore(core/rust): remove unneeded `use` statement
[no changelog]
4178d500 · Sep 21, 2026 · 1 fileTriage 0chore(core): added rules for strings already used by subset of layouts
[no changelog]
f8db4e90 · Sep 21, 2026 · 3 filesTriage 0chore(core): added and applied new blanking rules
[no changelog]
9023bae3 · Sep 21, 2026 · 5 filesTriage 0chore(core): remove unused send__cancel_transaction
[no changelog]
ebd0468e · Sep 21, 2026 · 1 fileTriage 0chore(l10n): organize blank translation rules
[no changelog]
0b65239c · Sep 21, 2026 · 5 filesTriage 0fix(core): fix -Wsign-compare warnings
[no changelog]
f18067ca · Sep 21, 2026 · 1 fileTriage 0chore(core): update fixtures
[no changelog]
4a9cf168 · Sep 21, 2026 · 12 filesModerate 59feat(core): app root packet downgrade protection
[no changelog]
This commit adds downgrade protection for a new 'app root packet' system in Trezor firmware. Previously, the code had a TODO note saying downgrade protection needed to be considered. The change makes the device remember the timestamps of previously accepted root packets and reject older or inconsistent ones. It also adds a new Python-exposed state object so the wallet software can persist these timestamps. This is a security-hardening feature rather than a fix for a currently exploitable bug, but it closes a design gap that could have allowed an attacker to roll back trusted application lists to older, potentially vulnerable versions.
9fb25562 · Sep 21, 2026 · 12 filesTriage 0feat(core): use 64-bit app root timestamps
[no changelog]
c51e9892 · Sep 21, 2026 · 3 filesTriage 0feat(core): expose app_root_min_timestamp()
[no changelog]
af27703f · Sep 21, 2026 · 4 filesTriage 0test(core): add tests for low-order keys in THP handshake
[no changelog]
429a283d · Sep 21, 2026 · 4 filesModerate 67fix(core/rust): discard low-order keys in THP handshake
[no changelog]
This commit fixes a cryptographic edge case in Trezor's THP (Trezor Host Protocol) handshake. It now rejects Curve25519 public keys that are all zeros or that produce an all-zero shared secret. A zero public key can cause the Diffie-Hellman exchange to collapse to a predictable value, which could let an attacker on the USB/bus learn or manipulate session keys. The patch also makes the handshake fail more gracefully for that single channel instead of aborting all channels.
d434a636 · Sep 21, 2026 · 1 fileInformational 11feat(core): enable `ward` with `miniscript`
[no changelog]
This commit changes one line in a build configuration file for the Trezor hardware wallet firmware. It adds the 'ward' feature to the existing 'miniscript' feature set. There is no direct evidence in the commit that this is a security fix; it appears to be a routine feature-enablement change. Without additional context, the security relevance is unclear and likely low.
7b58e75a · Sep 21, 2026 · 18 filesInformational 15feat(core): add `ward` feature flag
Will be used to incrementally introduce WARD-related functionality into
the codebase, while excluding it from production FW builds:
- add `ward` feature to the firmware build
- add `trezorward` MicroPython module, backed by a new `ward` module in
`trezor_lib` that depends on the shared `trezor-ward` crate
[no changelog]
This commit adds a new disabled-by-default feature flag called 'ward' to the Trezor firmware build system. It does not change any production firmware behavior; it only wires up a placeholder MicroPython module and build options so that future WARD-related code can be developed safely behind the flag. There is no security vulnerability visible in this change.
1cc940a4 · Sep 21, 2026 · 47 filesLow 27feat(core): enable -Wsign-compare
[no changelog]
This commit turns on a compiler warning (-Wsign-compare) that catches places where signed and unsigned numbers are compared, and fixes the resulting warnings across the Trezor firmware. Most changes are clean-up casts and loop-index type changes. A few spots also fix real logic bugs, such as treating a negative I/O return value as a successful byte count, or using the wrong argument index for an optional offset. These are defensive improvements rather than a single obvious exploit, but in embedded security code they can prevent subtle memory or parsing issues.
b89e7855 · Sep 21, 2026 · 3 filesTriage 0chore(core): update generated files
[no changelog]
65402aec · Sep 21, 2026 · 3 filesInformational 15refactor(core): merge passphrase__access_hidden_wallet into passphrase__access_wallet
[no changelog]
This commit is a simple user-interface cleanup. It removes one duplicate translation label ('Access hidden wallet') and makes the device use a single, consistent label ('Access wallet') when asking the user to confirm opening a passphrase-protected wallet. There is no change to security logic, cryptography, or how passphrases are handled.