Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…
Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…
Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.
This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …
This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…
NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…
Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
This commit is a simple rename from 'ProjectProfile' to 'ProjectConfig' in two Rust source files. It only changes variable names, struct names, and error messages. There is no change to program logic, security behavior, or how data is hand…
This commit is a straightforward internal code refactor in Trezor's build tooling. It introduces a new ResolvedBuildArgs structure that centralizes default values for command-line build options before they are used. There is no change to u…
This commit is a straightforward internal refactor of the Trezor firmware build tool's command-line argument handling. It changes many on/off flags from plain booleans to optional booleans so they can explicitly be set to true, false, or l…
This commit is a straightforward internal code reorganization in Trezor's build tooling. It moves build-option definitions from one Rust source file to a new module and adds the ability to load those options from a configuration file. Ther…
This commit is a developer tooling change for the Trezor firmware build system. It introduces 'build presets'—named configuration bundles stored in TOML files—so developers can select common build settings with a single command-line flag i…
This commit is a routine update to a build-system manifest file used by Trezor's internal tooling. It reorganizes and re-labels feature flags (for example, moving options between 'Features', 'Debugging', and 'Signing' groups and simplifyin…
This commit adds a single configuration file for a Trezor developer tool (a VS Code extension). It only points the tool to existing folders in the repository and contains no executable code, no secrets, and no changes to firmware behavior.…
This commit is a simple internal code cleanup: it renames a Rust data structure called ResolvedBuild to ResolvedBuildFeatures and updates the places that use it. There are no functional changes, no security fixes, and no changes to how the…
This is a tiny code cleanup commit that replaces two calls to `ptr::null()` with Rust's `unwrap_or_default()` to silence automated Clippy lint warnings. It does not change what value is produced (still a null pointer when no salt is provid…
This commit is a straightforward internal code cleanup in Trezor's build tooling. It moves a data structure and two helper methods from one Rust source file to another and updates callers accordingly. There is no change to user-facing beha…
This commit only adds documentation. It updates the table of contents and adds a new markdown page plus a diagram explaining the project's 'xtask' build helper. No code, build scripts, or firmware logic was changed, so it cannot introduce …
This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…
Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
This commit fixes a filename-renaming step in the project's automated nightly build pipeline. It ensures ARM64 emulator files get the correct name expected by another testing tool. There is no change to the actual Trezor firmware code, dev…
This is a routine housekeeping change to reduce clutter in Git's status output for a third-party component (the MicroPython submodule). There is no indication it changes any code that runs on the Trezor device or affects security.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100
This change moves some internal test-only Ethereum transaction display definitions from being permanently added to a global list to being generated on demand only when the device is running in debug/test mode. It is a memory-footprint and code-hygiene cleanup, not a fix for an exploitable security bug. There is no indication it addresses a vulnerability.
AI review queuedtest(core): drop `test_descriptor_all_formatters` unit testby Roman Zeyde · 3704e769 · Jul 1, 2026 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · Roman Zeyde
test(core): drop `test_descriptor_all_formatters` unit test
It should be covered by device tests.
[no changelog]
87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit simply removes a single unit test from the Trezor firmware test suite. The test covered Ethereum 'clear signing' formatting logic, and the commit message says it is being dropped because it should be covered by device tests instead. No production code was changed, so this does not introduce or fix a security vulnerability by itself.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates wording in Czech, German, Spanish, French, and Portuguese translation files, plus the translation signature metadata. There are no code, logic, cryptographic, or security behavior changes.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Security candidatefeat(clear_signing): support multi-value (array) fieldsby PrisionMike · f9f6eb97 · Jun 30, 2026 · 2 filesMessage 85 · StrongInformational 20Details
Commit message · PrisionMike
feat(clear_signing): support multi-value (array) fields
When a field's path resolves to an array, the formatter is applied to each element and the rendered values are joined with newlines (one value per line). Works for any formatter pointed at an array. Also renders booleans in RawFormatter (bool is not an int subclass under MicroPython).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 20/100
This commit adds support in Trezor's Ethereum 'clear signing' feature for displaying array (multi-value) fields on the device screen. It also fixes a minor display quirk where booleans were being treated as numbers. There is no direct evidence in the commit that this fixes an active security vulnerability; it reads as a feature improvement with some defensive hardening against malformed display definitions.
Security candidatetest(clear_signing): add Trezor Test descriptor and clear-signing testsby PrisionMike · c11f7477 · Jun 30, 2026 · 6 filesMessage 87 · StrongInformational 15Details
Commit message · PrisionMike
test(clear_signing): add Trezor Test descriptor and clear-signing tests
- Add test descriptors. - core tests.
[no changelog]
87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100
This commit only adds test code for Trezor's Ethereum clear-signing feature. It introduces debug-only test descriptors, unit tests, device tests, and expected screen snapshots. There is no change to production behavior or any fix for a security issue.
Security candidatefeat(clear_signing): identify a tokenAmount token by a constant addressby PrisionMike · c5aa2851 · Jun 30, 2026 · 5 filesMessage 85 · StrongInformational 19Details
Commit message · PrisionMike
feat(clear_signing): identify a tokenAmount token by a constant address
Adds an additive proto field (EthereumERC7730FieldInfo.const_token_address) and lets TokenAmountFormatter resolve its token from that literal address instead of a token_path - for descriptors whose token is a `$.metadata.constants.*` reference rather than a calldata parameter.
[no changelog]
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 19/100
This commit adds a new optional field to Trezor's Ethereum clear-signing protocol that lets a token amount be tied to a fixed contract address rather than pulled from transaction data. It is a feature addition, not a bug fix, and there is no evidence in the commit that it addresses a security flaw. The change does not appear to introduce an obvious vulnerability, but it slightly expands the attack surface by adding another way token addresses are resolved.
Security candidatefeat(clear_signing): add date and raw formatters. - core tests added. - proto updated. [no changelog]by PrisionMike · 600cf34e · Jun 30, 2026 · 7 filesMessage 87 · StrongInformational 21Details
Commit message · PrisionMike
feat(clear_signing): add date and raw formatters. - core tests added. - proto updated. [no changelog]
87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 21/100
This commit adds two new ways to display Ethereum transaction details on a Trezor screen: a 'raw' formatter that shows values as-is (numbers, text, or hex bytes) and a 'date' formatter that turns a Unix timestamp into a readable date. It also wraps some existing parsing and display steps in try/except blocks so failures are logged and re-raised. There is no direct evidence this fixes an active security bug; it looks like a feature addition for clearer transaction signing.
Lower-priorityci(core): use s5cmd for UI fixtures uploadby Roman Zeyde · 62db3706 · Jun 30, 2026 · 2 filesMessage 72 · AdequateTriage 0Details
Commit message · Roman Zeyde
ci(core): use s5cmd for UI fixtures upload
Our S3 bucket is at `eu-central-1`.
[no changelog]
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-priorityci(core): parallelize UI artifacts' generationby Roman Zeyde · 33965624 · Jun 30, 2026 · 1 fileMessage 84 · StrongTriage 0Details
Commit message · Roman Zeyde
ci(core): parallelize UI artifacts' generation
Also, deduplicate ZIP files to avoid overwriting.
[no changelog]
84/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode
Lower-priorityci(core): reduce ui-report action's verbosityby Roman Zeyde · de911a7e · Jun 30, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Roman Zeyde
ci(core): reduce ui-report action's verbosity
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritytest(core): make tests translation logic consistent with firmwareby Roman Zeyde · 55fb315a · Jun 30, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · Roman Zeyde
test(core): make tests translation logic consistent with firmware
[no changelog]
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
translation-only discount
Security candidatefix(core/caesar): fix `confirm_properties()` handling of `PageMsg::Info`by Roman Zeyde · 04621573 · Jun 30, 2026 · 1 fileMessage 62 · AdequateLow 33Details
Commit message · Roman Zeyde
fix(core/caesar): fix `confirm_properties()` handling of `PageMsg::Info`
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Low 33/100
This commit fixes a small Rust UI bug in Trezor's 'Caesar' firmware layout. When a user viewed an 'info' page during a confirmation prompt, the device previously failed to return the expected 'INFO' response and instead threw a type error. The patch adds the missing case so the info page is handled correctly. This is likely a user-experience or defensive bug fix rather than a critical security vulnerability, but it could affect how device confirmations behave.
Security candidatetest(core/caesar): visit menu only on last `ButtonPage`by Roman Zeyde · a0fe1ecc · Jun 30, 2026 · 2 filesMessage 87 · StrongInformational 15Details
Commit message · Roman Zeyde
test(core/caesar): visit menu only on last `ButtonPage`
Non-last pages don't have an info button on Caesar.
[no changelog]
87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This is a minor test-only adjustment for the Caesar user interface layout. It changes a test helper so that it only tries to open the menu on the last page of a multi-page screen, because earlier pages do not have a menu/info button. There is no change to production firmware behavior or security.
Security candidatechore(core): return to autolock menu after setting a new valueby Roman Zeyde · 62382b34 · Jun 30, 2026 · 3 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde
chore(core): return to autolock menu after setting a new value
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100
This commit is a minor user-interface polish change. After a user changes the auto-lock timeout setting on a Trezor device, the device now returns to the dedicated Auto-Lock menu instead of the broader Security menu. It does not change any security policy, cryptographic behavior, or data handling. The accompanying test updates simply expect the new screen.
Security candidatechore(tron): use pubhash for address derivation.by PrisionMike · 4b204ec9 · Jun 29, 2026 · 3 filesMessage 95 · StrongInformational 16Details
Commit message · PrisionMike
chore(tron): use pubhash for address derivation.
- avoids calling private key in python for public key derivation. - removing a function that was only used in tests.
[no changelog]
95/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
secret or key material
AI analysis · Informational 16/100
This commit changes how Trezor hardware wallets derive TRON addresses. Previously, the code loaded the private key into Python memory and computed the public key from it. Now it uses a precomputed public-key hash already available from the keychain. This is a defensive hardening change that reduces the chance of private-key exposure in the Python layer, but it does not by itself fix a known exploitable vulnerability.
Security candidatefeat(tron): add support for `WithdrawBalanceContract`by PrisionMike · c687e153 · Jun 29, 2026 · 13 filesMessage 62 · AdequateInformational 12Details
Commit message · PrisionMike
feat(tron): add support for `WithdrawBalanceContract`
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 12/100
This commit adds support for a new Tron blockchain transaction type called WithdrawBalanceContract, which lets users claim their voting rewards. It also improves the on-device confirmation flow for claim transactions so the device warns and shows the owner address when the transaction is being signed on behalf of a different account. There is no indication of a security vulnerability in the change itself; it appears to be a normal feature addition with stronger user confirmation.
AI review queuedchore(tron): scaffolding for `WithdrawBalanceContract`by PrisionMike · 2b93024e · Jun 29, 2026 · 18 filesMessage 62 · AdequateInformational 15Details
Commit message · PrisionMike
chore(tron): scaffolding for `WithdrawBalanceContract`
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds support for a new Tron blockchain operation called 'WithdrawBalanceContract' (claiming voting rewards). It is a feature addition: new message types, generated code, translations, and a test fixture. There is no indication of a security bug or vulnerability fix in the diff.
Security candidatefix(core): keep vertical offset when reloading device menuby Roman Zeyde · f383055e · Jun 29, 2026 · 13 filesMessage 62 · AdequateInformational 18Details
Commit message · Roman Zeyde
fix(core): keep vertical offset when reloading device menu
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 18/100
This commit fixes a visual glitch on the Trezor T3W1 device where the device menu would visibly jump or flicker when it refreshed. The fix preserves the menu's current scroll position across refreshes by passing an extra offset value through the UI API. There is no indication this change addresses a security vulnerability.
Lower-prioritychore(core): update UI fixturesby Roman Zeyde · c9e32e77 · Jun 29, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Roman Zeyde
chore(core): update UI fixtures
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfeat(core): allow fallible conversion of `i16` into `Obj`by Roman Zeyde · 8ad34606 · Jun 29, 2026 · 1 fileMessage 77 · AdequateTriage 0Details
Commit message · Roman Zeyde
feat(core): allow fallible conversion of `i16` into `Obj`
Similar to `u16` and `u8`.
[no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Security candidaterefactor(core/eckhart): simplify device menu handlingby Roman Zeyde · e6e514c9 · Jun 29, 2026 · 7 filesMessage 85 · StrongInformational 15Details
Commit message · Roman Zeyde
refactor(core/eckhart): simplify device menu handling
- use Qstrs as DeviceMenuResult variants - replace `result_arg` by an explicit `DeviceMenuMsg` variant - don't replace `DeviceMenuMsg::Close` by `CANCELLED` - unify parent menu ID & menu refresh logic
[no changelog]
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100
This is a code cleanup (refactor) for the device menu on a specific Trezor hardware wallet model. It changes how menu actions are represented internally (from numbers to named strings) and simplifies how the menu decides which submenu to show next. There is no indication this fixes a security bug or introduces a vulnerability.
Lower-priorityfix(core): logic error in `ToifInfo::parse`by obrusvit · 368d6203 · Jun 27, 2026 · 5 filesMessage 82 · StrongTriage 0Details
Commit message · obrusvit
fix(core): logic error in `ToifInfo::parse`
- device test wrong TOIF prefix - chore: rename relevant test functions to caesar
[no changelog]
82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Security candidatedocs(core/rust): fix a small typoby Roman Zeyde · 72540c6c · Jun 26, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Roman Zeyde
docs(core/rust): fix a small typo
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100
This commit fixes a spelling mistake in a code comment ('Chcek' to 'Check'). No program logic, user interface behavior, or security properties were changed.
Security candidatechore(core/rust): use `deref()` instead of `deref_mut()`by Roman Zeyde · 61557dca · Jun 26, 2026 · 1 fileMessage 62 · AdequateInformational 12Details
Commit message · Roman Zeyde
chore(core/rust): use `deref()` instead of `deref_mut()`
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 12/100
This is a one-line code cleanup in the user-interface code for a Trezor hardware wallet screen. It changes a mutable borrow (`deref_mut`) to an immutable borrow (`deref`) where the code only reads a value. This is a routine Rust style/refactor change with no visible security effect.