Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…
Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…
Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.
This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …
This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…
NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…
Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…
This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…
Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…
This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…
Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.
This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…
This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The chang…
No security-relevant logic changes observedNo input validation changesNo memory safety bug fixes (e.g., no overflow, use-after-free, or uninitialized memory fixes)
This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…
Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. T…
This commit is a large but purely mechanical code cleanup: it replaces the custom STATIC macro with the standard C keyword static across many MicroPython module files. There is no change to program logic, security boundaries, or behavior. …
This commit is a routine code cleanup that updates Trezor firmware to match a newer MicroPython version where built-in module names dropped the 'u' prefix (for example, 'uos' became 'os' and 'ustruct' became 'struct'). It renames imports, …
This commit only updates the firmware version number from 2.12.4 to 2.12.5 in the source code and translation files. It does not change any security-related logic, fix any bug, or alter any cryptographic behavior. It is a routine release b…
This is a routine build-system cleanup for the Trezor firmware. It switches the internal 'trezor_lib' Rust crate to be built with the project's own 'xbuild' tool, removes transitional feature flags, and reorganizes Cargo.toml files. There …
This commit adds Bluetooth Low Energy (BLE) support for the Trezor T3T2 hardware model. It introduces new board configuration files, pin mappings, build scripts, and firmware binaries for the Nordic nRF54LS05A BLE radio used in T3T2. There…
- do not persist conflicting token from actions/checkout - remove failing git command that is no longer needed - explicitly specify required permissions
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
credential or privilege statedocumentation-only discount
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
defensive validationsigning or wallet pathsecond-pass: near security thresholdsecond-pass: security-sensitive path
Lower-prioritydocs(core): add a changelog entry for #7388by Roman Zeyde · d483d11f · Jul 28, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · Roman Zeyde
docs(core): add a changelog entry for #7388
It has been introduced in #7175, and fixed in #6676 (THP 🦀).
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Lower-prioritychore(vendor): update `ts-tvl` to version 2.5by M1nd3r · f867d6ff · Jul 28, 2026 · 2 filesMessage 57 · ThinTriage 0Details
Commit message · M1nd3r
chore(vendor): update `ts-tvl` to version 2.5
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
chore(crypto): replace `int` by `size_t` for nonnegative parameters
Assisted-by: Claude, Opus 5
[no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Low 34/100
This commit is a code-quality cleanup that changes many function parameters from signed integers (`int`) to unsigned size types (`size_t`) where only non-negative lengths or sizes make sense. It also removes some now-unnecessary negative-value checks and adjusts callers/tests accordingly. The change is defensive: using `size_t` prevents accidental negative lengths from being interpreted as huge positive values, which can cause memory corruption or information leaks. The commit itself does not claim to fix a specific vulnerability, and no external security advisory is supplied.
Security candidatefeat(core): compose Stellar authorization entry labels as root label + path.by Jun Luo · ad830fa9 · Jul 28, 2026 · 1 fileMessage 98 · StrongInformational 15Details
The same auth entry now renders with the same sub-invocation paths regardless of where it appears: "Authorization #2" for the entry itself and "Authorization #2.1", "Authorization #2.1.1", ... for its (nested) sub-invocations.
[no changelog]
98/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
access control
AI analysis · Informational 15/100
This commit only changes the on-screen text labels shown when a Trezor device asks the user to confirm a Stellar blockchain authorization. It renames labels from formats like 'Authorization 2' and '1-2-1' to 'Authorization #2' and '#2.1.1'. There is no security vulnerability or fix here; it is a user-interface clarity improvement.
Security candidatefeat(common,core,python,tests): support signing Stellar Soroban authorization entries.by Jun Luo · 6008cc25 · Jul 28, 2026 · 25 filesMessage 100 · StrongLow 36Details
Commit message · Jun Luo
feat(common,core,python,tests): support signing Stellar Soroban authorization entries.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryaccess controlsigning or wallet pathboot or update pathauthentication path
AI analysis · Low 36/100
This commit adds a new Trezor feature that lets users sign Stellar Soroban smart-contract authorization entries. The device now supports a new message type where it derives the user's Stellar address, shows confirmation screens, and produces an Ed25519 signature over a protocol-defined authorization payload. The change is a feature addition rather than a bug fix, and the signing flow includes user confirmation steps.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
signing boundaryaccess controlsigning or wallet pathauthentication path
AI analysis · Informational 15/100
This commit only adds new automated tests for signing Stellar Soroban authorizations. It does not change any production firmware, wallet logic, or cryptographic code. There is no security vulnerability here.
AI review queuedchore(core/stellar): make gen and fixturesby obrusvit · 94d39e3c · Jul 28, 2026 · 6 filesMessage 57 · ThinTriage 12Details
Commit message · obrusvit
chore(core/stellar): make gen and fixtures
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Security candidaterefactor(core/stellar): move generic Soroban writers to writers.py.by Jun Luo · 5f24e157 · Jul 28, 2026 · 5 filesMessage 90 · StrongInformational 15Details
Commit message · Jun Luo
refactor(core/stellar): move generic Soroban writers to writers.py.
SCVal, SCAddress and authorized-invocation writers are used by both the transaction flow and the standalone authorization signing flow, so they are no longer operation-specific.
[no changelog]
90/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryaccess controlsigning or wallet pathauthentication path
AI analysis · Informational 15/100
This commit is a straightforward code cleanup: it moves several Stellar Soroban serialization helper functions from an operation-specific file into a shared writers module so both transaction signing and standalone authorization signing can use the same code. No behavior changes, bug fixes, or security fixes are visible in the diff.
Security candidaterefactor(core/stellar): move generic Soroban layout helpers to layout.py.by Jun Luo · 9ce451bd · Jul 28, 2026 · 4 filesMessage 90 · StrongInformational 15Details
Commit message · Jun Luo
refactor(core/stellar): move generic Soroban layout helpers to layout.py.
SCVal formatting and invocation confirmation helpers are used by both the transaction flow and the standalone authorization signing flow, so they are no longer operation-specific.
[no changelog]
90/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryaccess controlsigning or wallet pathauthentication path
AI analysis · Informational 15/100
This commit is a straightforward code cleanup: it moves helper functions for formatting Stellar Soroban smart-contract values and showing confirmation screens from one file to another shared file. No security behavior changes are visible in the diff. The only functional tweak is narrowing an exception handler from a broad 'except Exception' to 'except OverflowError' when formatting timestamps, which is a minor hardening improvement, not a vulnerability.
Security candidatefeat(common,core,python,tests): migrate Soroban authorization to SOROBAN_CREDENTIALS_ADDRESS_V2.by Jun Luo · 0d2cc2ac · Jul 28, 2026 · 13 filesMessage 77 · AdequateLow 29Details
Commit message · Jun Luo
feat(common,core,python,tests): migrate Soroban authorization to SOROBAN_CREDENTIALS_ADDRESS_V2.
[no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
access controlcredential or privilege statesigning or wallet path
AI analysis · Low 29/100
This commit updates Trezor's Stellar/Soroban smart-contract support to match a newer Stellar protocol version (Protocol 27). It renames the credential type from the older SOROBAN_CREDENTIALS_ADDRESS to SOROBAN_CREDENTIALS_ADDRESS_V2 and updates the related field name from address to address_v2 across the firmware, Python library, Rust client, and tests. The older credential type is intentionally no longer supported. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a routine protocol compatibility update.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Security candidatefix(core): chance fstrings to with_colon in Bolt Caesar [no changelog]by Michal Kazda · 22c18909 · Jul 28, 2026 · 2 filesMessage 77 · AdequateInformational 15Details
Commit message · Michal Kazda
fix(core): chance fstrings to with_colon in Bolt Caesar [no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a code cleanup in the Trezor hardware wallet's user interface. It replaces hard-coded colon punctuation (like 'Amount:') with a helper function called with_colon that adds the colon in a translation-friendly way. There is no security issue here.