Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…
Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…
Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.
This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …
This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…
NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…
Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
This commit is a simple rename from 'ProjectProfile' to 'ProjectConfig' in two Rust source files. It only changes variable names, struct names, and error messages. There is no change to program logic, security behavior, or how data is hand…
This commit is a straightforward internal code refactor in Trezor's build tooling. It introduces a new ResolvedBuildArgs structure that centralizes default values for command-line build options before they are used. There is no change to u…
This commit is a straightforward internal refactor of the Trezor firmware build tool's command-line argument handling. It changes many on/off flags from plain booleans to optional booleans so they can explicitly be set to true, false, or l…
This commit is a straightforward internal code reorganization in Trezor's build tooling. It moves build-option definitions from one Rust source file to a new module and adds the ability to load those options from a configuration file. Ther…
This commit is a developer tooling change for the Trezor firmware build system. It introduces 'build presets'—named configuration bundles stored in TOML files—so developers can select common build settings with a single command-line flag i…
This commit is a routine update to a build-system manifest file used by Trezor's internal tooling. It reorganizes and re-labels feature flags (for example, moving options between 'Features', 'Debugging', and 'Signing' groups and simplifyin…
This commit adds a single configuration file for a Trezor developer tool (a VS Code extension). It only points the tool to existing folders in the repository and contains no executable code, no secrets, and no changes to firmware behavior.…
This commit is a simple internal code cleanup: it renames a Rust data structure called ResolvedBuild to ResolvedBuildFeatures and updates the places that use it. There are no functional changes, no security fixes, and no changes to how the…
This is a tiny code cleanup commit that replaces two calls to `ptr::null()` with Rust's `unwrap_or_default()` to silence automated Clippy lint warnings. It does not change what value is produced (still a null pointer when no salt is provid…
This commit is a straightforward internal code cleanup in Trezor's build tooling. It moves a data structure and two helper methods from one Rust source file to another and updates callers accordingly. There is no change to user-facing beha…
This commit only adds documentation. It updates the table of contents and adds a new markdown page plus a diagram explaining the project's 'xtask' build helper. No code, build scripts, or firmware logic was changed, so it cannot introduce …
This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…
Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
This commit fixes a filename-renaming step in the project's automated nightly build pipeline. It ensures ARM64 emulator files get the correct name expected by another testing tool. There is no change to the actual Trezor firmware code, dev…
This is a routine housekeeping change to reduce clutter in Git's status output for a third-party component (the MicroPython submodule). There is no indication it changes any code that runs on the Trezor device or affects security.
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedchore: add hardcoded 1inch definitionsby Ioan Bizău · 730cbd94 · Jun 15, 2026 · 2 filesMessage 80 · StrongInformational 19Details
Commit message · Ioan Bizău
chore: add hardcoded 1inch definitions
This reverts commit dc1f3a1b4d81900ab0a406617f5efb7e200df14e but adds more definitions that what was there.
[no changelog]
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100
This commit adds human-readable display definitions for 1inch decentralized-exchange swap transactions on Trezor hardware wallets. It tells the wallet how to decode and label 1inch swap parameters (amounts, beneficiary, last pool) so users can verify what they are signing on the device screen. The change is purely a data/configuration addition plus matching tests; it does not alter cryptographic code, transaction validation, or signing logic. There is no indication in the commit that this fixes a security vulnerability.
Lower-prioritybuild(core): exclude D001/D002-related bytecodeby Roman Zeyde · 7ee98685 · Jun 15, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Roman Zeyde
build(core): exclude D001/D002-related bytecode
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidaterefactor(core): enforce layout scoping for more Rust layoutsby Roman Zeyde · 05d4b6df · Jun 15, 2026 · 22 filesMessage 93 · StrongInformational 21Details
Commit message · Roman Zeyde
refactor(core): enforce layout scoping for more Rust layouts
Following https://github.com/trezor/trezor-firmware/pull/6812.
Also, fixup `error_popup()` return value, since it is unused.
[no changelog]
93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathboot or update pathauthentication path
AI analysis · Informational 21/100
This commit is a code cleanup that wraps more on-screen UI layouts in a new 'layout context' scoping mechanism. It changes how layout objects are created and awaited, but does not add or remove security checks. The main risk is that any mistake in the refactor could cause a layout to be used outside its intended scope, but the diff itself shows consistent mechanical changes rather than a security fix or vulnerability.
- BIP39 and SLIP39 1-of-1 do not send `success_share_confirm`. - All models send `success_backup`.
[no changelog]
82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
secret or key material
AI analysis · Informational 15/100
This commit only updates automated test scripts for the Trezor hardware wallet. It changes how the test code simulates button presses during a wallet backup flow to match the actual device behavior. There is no change to the firmware or wallet security itself.
Lower-prioritytest(core): extend backup device tests with N4W1 methodby Roman Zeyde · a4657911 · Jun 13, 2026 · 3 filesMessage 72 · AdequateTriage 0Details
Commit message · Roman Zeyde
test(core): extend backup device tests with N4W1 method
[no changelog]
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritychore(core): update UI fixturesby Roman Zeyde · b928f57d · Jun 12, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Roman Zeyde
chore(core): update UI fixtures
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidaterefactor(core): make `trezorui_api.LayoutContext` a protocolby Roman Zeyde · ceaa514f · Jun 12, 2026 · 2 filesMessage 85 · StrongInformational 15Details
Commit message · Roman Zeyde
refactor(core): make `trezorui_api.LayoutContext` a protocol
Functions that accept `LayoutContext` can be called with a `LayoutObj` (since it also has appropriate __enter__/__exit__ methods).
[no changelog]
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100
This is a small, safe code cleanup. It changes a type annotation from a concrete class to a protocol (an interface definition) and updates two function signatures to return the more general interface type. There is no change to actual program behavior, no bug fix, and no security relevance.
Lower-priorityrefactor(core): enforce scoping for homescreen/lockscreen layoutsby Roman Zeyde · cad03aa5 · Jun 12, 2026 · 3 filesMessage 93 · StrongTriage 0Details
Commit message · Roman Zeyde
refactor(core): enforce scoping for homescreen/lockscreen layouts
Progress layouts still rely on GC for deallocation.
Following https://github.com/trezor/trezor-firmware/pull/6812.
[no changelog]
93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-prioritychore(core): update libtropic to v4.0.0by Ondřej Vejpustek · 24660add · Jun 12, 2026 · 8 filesMessage 57 · ThinTriage 0Details
Commit message · Ondřej Vejpustek
chore(core): update libtropic to v4.0.0
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfix(prodtest): continue in case of handshake errorby Ondřej Vejpustek · 6eaa5bc9 · Jun 12, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Ondřej Vejpustek
fix(prodtest): continue in case of handshake error
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI review queuedfix(python): skip stale protocol v1 responsesby Roman Zeyde · 1edb54ac · Jun 12, 2026 · 4 filesMessage 57 · ThinLow 47Details
Commit message · Roman Zeyde
fix(python): skip stale protocol v1 responses
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Low 47/100
This update fixes a bug in the Trezor Python library where reconnecting to a Trezor device could fail if an old, unread response was still waiting in the communication channel. The fix makes the library clear out up to 10 stale responses before it checks whether the device speaks the older protocol v1. A new test simulates a host disconnect mid-operation and verifies that a new client can reconnect successfully.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefix(core): fix overflowing text in Delizia bldby obrusvit · d48e3b24 · Jun 9, 2026 · 1 fileMessage 80 · StrongInformational 16Details
Commit message · obrusvit
fix(core): fix overflowing text in Delizia bld
- these should not be visible in the regular user flow anyway since we introduced interactionless update
[no changelog]
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
memory safetyboot or update path
AI analysis · Informational 16/100
This commit shortens two on-screen text labels in the Trezor bootloader from 'INSTALL FIRMWARE' to 'INSTALL FW' and 'UPDATE FIRMWARE' to 'UPDATE FW'. The change is purely cosmetic, intended to stop the text from overflowing its display area. The commit message notes these screens are not normally seen by users because updates now happen without user interaction. There is no security fix here.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 17/100
This commit adds support for a new post-quantum digital-signature algorithm (ML-DSA-44) to the Python trezorctl tool's device-authenticity check. It does not change how the hardware wallet itself works; it only lets the desktop companion software recognize and verify a new type of manufacturer signature on some devices. The change also moves hard-coded root public keys into a separate internal module and updates the required cryptography library version. There is no indication in the commit that this fixes a security bug or vulnerability.
Lower-priorityfeat(trezorctl): Add --devel option to authenticate command.by Andrew Kozlik · f7bd63b8 · Jun 9, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Andrew Kozlik
feat(trezorctl): Add --devel option to authenticate command.
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefeat(trezorctl): Check device certificate CN and SN consistency.by Andrew Kozlik · 9f72b329 · Jun 9, 2026 · 1 fileMessage 62 · AdequateLow 45Details
Commit message · Andrew Kozlik
feat(trezorctl): Check device certificate CN and SN consistency.
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 45/100
This commit strengthens the Trezor host-side device-authentication check. Previously, the tool verified that each security chip's certificate chain was signed by a trusted root, but it did not compare the device model and serial number written into the different certificates. The patch now extracts the common name (model) and serial number from each certificate and rejects the device if those values disagree across chips or do not match the model the device claims to be. This closes a gap where a malicious or misconfigured device might present otherwise valid but mismatched certificates.
Lower-prioritychore(python): decrease `EMULATOR_WAIT_TIME` to 30sby Roman Zeyde · 7cca0c19 · Jun 9, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Roman Zeyde
chore(python): decrease `EMULATOR_WAIT_TIME` to 30s
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityci(core): set upgrade tests timeout to 20mby Roman Zeyde · 2f4f7027 · Jun 9, 2026 · 1 fileMessage 82 · StrongTriage 0Details
Commit message · Roman Zeyde
ci(core): set upgrade tests timeout to 20m
Also, increase individual test timeout to be > EMULATOR_WAIT_TIME.
[no changelog]
82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
documentation-only discount
Lower-priorityci: hw: allow choosing models when running manuallyby Martin Milata · 7161614d · Jun 9, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Martin Milata
ci: hw: allow choosing models when running manually
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body