TZ
← All projectsTrezor

Trezor firmware

Firmware monorepo for Trezor One, Model T, and Safe devices.

BitcoinHardware walletsNormal
Repository coverage

2656 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

916security candidates311second-pass queue1304AI analyses
339commits · 30 days
583commits · 60 days
1358commits · 180 days
2650commits · 365 days
Backfill bands
Aug 5 → Feb 61298 seen115 candidatesComplete
Feb 6 → Jun 6775 seen58 candidatesComplete
Jun 6 → Jul 6217 seen13 candidatesComplete
Jul 6 → Aug 5360 seen54 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
473Strong · 80–100
1318Adequate · 60–79
860Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
PrisionMike945978273
Andrew Kozlik712432265
Roman Zeyde571177251171
tychovrahe292104122161
Jakub Janků19915184
Martin Pastyřík23810173
cepetr19682102059
Ioan Bizău23076140059
obrusvit21376106064
M1nd3r2067195071
Lukas Bielesch846771067
Martin Milata1744671063
Analysis record

Published AI watches

Last scanned 34 minutes ago

Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove sha1 from regular FW

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…

Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
16d15774by M1nd3r+0−2006 files
No security note in commit
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…

Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
1b3128a4by Ondřej Vejpustek+20−92 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): change order of parameters

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

33a119eeby Ondřej Vejpustek+15−151 file
No security note in commit
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): prefix enums

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …

f1c74046by Ondřej Vejpustek+26−222 files
No security note in commit
Low 37 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): prevent calling `memzero(NULL, ...)`

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…

NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
0394e934by Ondřej Vejpustek+11−51 file
No security note in commit
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): return remote static key from `noise_xxpsk3_*_handle_*()`

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…

Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
3ead1aa6by Ondřej Vejpustek+79−423 files
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): rename ProjectProfile to ProjectConfig

This commit is a simple rename from 'ProjectProfile' to 'ProjectConfig' in two Rust source files. It only changes variable names, struct names, and error messages. There is no change to program logic, security behavior, or how data is hand…

581b37bcby cepetr+18−182 files
No security note in commit
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): introduce ResolvedBuildArgs

This commit is a straightforward internal code refactor in Trezor's build tooling. It introduces a new ResolvedBuildArgs structure that centralizes default values for command-line build options before they are used. There is no change to u…

c24d1be8by cepetr+99−295 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): make build args tristate

This commit is a straightforward internal refactor of the Trezor firmware build tool's command-line argument handling. It changes many on/off flags from plain booleans to optional booleans so they can explicitly be set to true, false, or l…

271e249aby cepetr+57−561 file
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): introduce build options

This commit is a straightforward internal code reorganization in Trezor's build tooling. It moves build-option definitions from one Rust source file to a new module and adds the ability to load those options from a configuration file. Ther…

75085e2aby cepetr+275−2007 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce build presets

This commit is a developer tooling change for the Trezor firmware build system. It introduces 'build presets'—named configuration bundles stored in TOML files—so developers can select common build settings with a single command-line flag i…

eefe8f7fby cepetr+397−419 files
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): upgrade manifest.yaml for tf-tools 0.3.0

This commit is a routine update to a build-system manifest file used by Trezor's internal tooling. It reorganizes and re-labels feature flags (for example, moving options between 'Features', 'Debugging', and 'Signing' groups and simplifyin…

57b28b89by cepetr+86−1351 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add tf-tools 0.3.1+ configuration file

This commit adds a single configuration file for a Trezor developer tool (a VS Code extension). It only points the tool to existing folders in the repository and contains no executable code, no secrets, and no changes to firmware behavior.…

e554f618by cepetr+8−01 file
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): rename ResolvedBuild to ResolvedBuildFeatures

This commit is a simple internal code cleanup: it renames a Rust data structure called ResolvedBuild to ResolvedBuildFeatures and updates the places that use it. There are no functional changes, no security fixes, and no changes to how the…

aaa2780bby cepetr+5−52 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fix up clippy warnings in storage.rs

This is a tiny code cleanup commit that replaces two calls to `ptr::null()` with Rust's `unwrap_or_default()` to silence automated Clippy lint warnings. It does not change what value is produced (still a null pointer when no salt is provid…

62354461by cepetr+2−21 file
No security note in commit
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): simplify dependencies

This commit is a straightforward internal code cleanup in Trezor's build tooling. It moves a data structure and two helper methods from one Rust source file to another and updates callers accordingly. There is no change to user-facing beha…

6268349fby cepetr+9−193 files
No security note in commit
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

docs: add xtask documentation

This commit only adds documentation. It updates the table of contents and adds a new markdown page plus a diagram explaining the project's 'xtask' build helper. No code, build scripts, or firmware logic was changed, so it cannot introduce …

4879dababy cepetr+296−03 files
No security note in commit
Informational 17 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce project-toml build-options

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…

Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
d44de007by cepetr+681−40817 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): fix nightly ARM emulator filename

This commit fixes a filename-renaming step in the project's automated nightly build pipeline. It ensures ARM64 emulator files get the correct name expected by another testing tool. There is no change to the actual Trezor firmware code, dev…

ab95f08fby Martin Milata+3−01 file
No security note in commit
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(vendor): avoid micropython submodule noise in git status

This is a routine housekeeping change to reduce clutter in Git's status output for a third-party component (the MicroPython submodule). There is no indication it changes any code that runs on the Trezor device or affects security.

06cab32bby Martin Milata+1−11 file
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidatefeat(vendor): don't rebuild MicroPython to exclude source line databy Roman Zeyde · b457c817 · Apr 13, 2026 · 6 filesMessage 93 · StrongInformational 17Details
Commit message · Roman Zeyde

feat(vendor): don't rebuild MicroPython to exclude source line data

Fixes https://github.com/trezor/trezor-firmware/issues/6715.

Needs https://github.com/trezor/micropython/pull/29.

[no changelog]

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update path
AI analysis · Informational 17/100

This commit changes how the Trezor firmware build system handles source-line information in its embedded MicroPython interpreter. Previously, enabling or disabling source-line data required rebuilding the MicroPython cross-compiler. After this change, the same compiler binary can include or omit source lines via a command-line flag. This is a build-system convenience and optimization; it does not fix a vulnerability in user-facing code.

Security candidatebuild(core): exclude `storage.cache_codec` from THP buildsby Roman Zeyde · 7bbda7bf · Apr 10, 2026 · 3 filesMessage 85 · StrongInformational 18Details
Commit message · Roman Zeyde

build(core): exclude `storage.cache_codec` from THP builds

THP PYOPT=1 builds don't need it.

THP PYOPT=0 builds need DebugLink functionality, but don't use `CodecContext`'s cache-related methods.

Reduces THP build flash usage by ~1kB.

[no changelog]

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 18/100

This is a build-system cleanup for Trezor firmware. It removes an unused storage cache module from a specific firmware variant (THP builds) to save about 1 kB of flash space. The code change also makes sure that when the module is excluded, the few functions that relied on it are skipped too. There is no direct security bug here, but any build-system change that alters which code is compiled into a hardware wallet deserves a quick sanity check.

Security candidatefix(core/eckhart): homescreen alignment issuesby obrusvit · 05044544 · Apr 10, 2026 · 2 filesMessage 72 · AdequateInformational 15Details
Commit message · obrusvit

fix(core/eckhart): homescreen alignment issues

- fix incorrectly placed connection indicator in some cases
- slightly align the label

[no changelog]

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit fixes visual alignment of icons and text on the Trezor hardware wallet's homescreen for the Eckhart layout. It adjusts where the connection indicator and device label are drawn so they line up correctly with the battery icon. There is no security relevance in this change.

Security candidatefix(eckhart, ui): consistent cancel layoutby PrisionMike · 69f7d0eb · Apr 9, 2026 · 6 filesMessage 80 · StrongInformational 15Details
Commit message · PrisionMike

fix(eckhart, ui): consistent cancel layout

Eckhart should not have cancel option as a 'x' on the action bar but should instead be an option in the menu, like Delizia.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100

This is a user-interface consistency patch for the Trezor hardware wallet's 'Eckhart' design. It moves the 'cancel' option from a small 'X' button on the action bar into a menu, matching how the newer 'Delizia' design already works. There is no security bug being fixed here; it is purely a layout and navigation change.

Security candidatechore(eckhart, ui): make warning style for footer optionalby PrisionMike · 066d5921 · Apr 9, 2026 · 14 filesMessage 85 · StrongInformational 19Details
Commit message · PrisionMike

chore(eckhart, ui): make warning style for footer optional

- Warning_footer is not "footer" + "is_footer_warning"
- Changes had to be propagated across other layouts for commonality.

[no changelog]

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 19/100

This is a routine user-interface refactor for the Trezor hardware wallet firmware. It renames a parameter from 'warning_footer' to 'footer' and allows the footer text to be shown either as a warning (red/alert style) or as a normal informational hint. The change touches many UI test snapshots because screen layouts changed slightly, but there is no evidence of a security vulnerability or fix.

Security candidatefix(style): update C-style to be compliant with clang-format 21.1.8by M1nd3r · 8bdfe004 · Apr 9, 2026 · 67 filesMessage 77 · AdequateInformational 15Details
Commit message · M1nd3r

fix(style): update C-style to be compliant with clang-format 21.1.8

- previous clang-format version was 17.0.6

[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathboot or update path
AI analysis · Informational 15/100

This commit is purely a code-style cleanup. It updates the project's C source files so they match the formatting rules of a newer version of the clang-format tool (version 21.1.8 instead of 17.0.6). The changes are limited to whitespace, line breaks, comment placement, and how macros and attributes are laid out. No program logic, security checks, or behavior were changed.

Security candidatechore(layout): make `verb_info` optional in `confirm_with_info`by PrisionMike · 202dd3e7 · Apr 8, 2026 · 8 filesMessage 62 · AdequateInformational 15Details
Commit message · PrisionMike

chore(layout): make `verb_info` optional in `confirm_with_info`

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This is a routine user-interface cleanup change. It makes one button label parameter optional across several Trezor device layouts and updates the Python helper that calls it. There is no security-relevant behavior change: the same screens are shown, only the internal plumbing for deciding whether to display an extra 'info' button is simplified.

Security candidatefeat(ethereum): Add support for vault depositby PrisionMike · 84510ddc · Apr 8, 2026 · 12 filesMessage 82 · StrongInformational 12Details
Commit message · PrisionMike

feat(ethereum): Add support for vault deposit

- Added Vault deposit flow.
- Tests WIP.
- changelog will be added after all 4 vault flows are done.

[no changelog]

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 12/100

This commit adds a new user-facing feature to Trezor hardware wallets: clear signing support for ERC-4626 'vault deposit' transactions on Ethereum. It introduces code that recognizes a specific smart-contract function call, shows the user a friendly confirmation screen with the vault name and deposit amount, and only proceeds if safety checks pass. There is no indication in the commit that this fixes a security bug; it appears to be a normal feature addition.

Security candidatedocs: add thp documentationby M1nd3r · b12a0109 · Apr 8, 2026 · 14 filesMessage 47 · ThinInformational 15Details
Commit message · M1nd3r

docs: add thp documentation

[no changelog]

47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathauthentication pathparser or protocol pathdocumentation-only discount
AI analysis · Informational 15/100

This commit is purely a documentation update for the Trezor firmware repository. It reorganizes existing documentation, adds new documentation for the Trezor-Host Protocol (THP), and moves Bitcoin signing and protocol v1 docs to new locations. No executable code, firmware logic, or security-sensitive behavior was changed.

Security candidatefeat(core): allow blanking `select_word()` itemsby Roman Zeyde · 1b880451 · Apr 8, 2026 · 1 fileMessage 80 · StrongInformational 18Details
Commit message · Roman Zeyde

feat(core): allow blanking `select_word()` items

Will be used to allow choosing 2 options (instead of 3).
In that case, the 2nd separator should not be rendered.

[no changelog]

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 18/100

This commit is a small UI layout change for the Trezor hardware wallet. It lets a screen that normally shows three word choices display only two choices by leaving one slot blank and hiding the separator line next to it. There is no indication this fixes a security bug; it appears to be a feature tweak for a future user interface.

Security candidatetest(core): test backup cancellation during `ResetDevice`by Roman Zeyde · c72a83e8 · Apr 7, 2026 · 3 filesMessage 87 · StrongInformational 15Details
Commit message · Roman Zeyde

test(core): test backup cancellation during `ResetDevice`

Previously, backup cancellation was tested only during `BackupDevice`.

[no changelog]

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit only adds new automated tests that simulate a user cancelling the backup step during device setup (ResetDevice). It does not change the actual Trezor firmware code, wallet logic, or fix any bug. It is a testing improvement with no direct security impact on shipped devices.

Security candidatefix(translations,cardano): translations for credentials phrase in cardanoby PrisionMike · 45e6ab73 · Apr 4, 2026 · 9 filesMessage 77 · AdequateInformational 15Details
Commit message · PrisionMike

fix(translations,cardano): translations for credentials phrase in cardano

- Refactored some TR string for better l10n.
- Minor code adjustment around it.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
credential or privilege statesigning or wallet path
AI analysis · Informational 15/100

This commit is a routine translation and user-interface wording update for the Cardano cryptocurrency flow on Trezor hardware wallets. It rephrases on-screen labels such as changing 'key hash' to 'Key hash' and replacing some message-signing prompts with a new credential description template. There is no indication of a security vulnerability being fixed or introduced.

Security candidatetest(core): simplify unittests' context handlingby Roman Zeyde · 278e1340 · Apr 2, 2026 · 9 filesMessage 82 · StrongInformational 15Details
Commit message · Roman Zeyde

test(core): simplify unittests' context handling

Extract context setup/teardown into `TestCaseWithContext`.

[no changelog]

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit is a test-code cleanup only. It moves repeated setup and teardown code for unit tests into a shared helper class, TestCaseWithContext. There are no changes to the actual firmware, wallet logic, cryptography, or any code that runs on a real Trezor device. It cannot affect user funds, device security, or real-world attacks.

Security candidatetest(core): remove unused imports from unittestsby Roman Zeyde · 766aafeb · Apr 2, 2026 · 5 filesMessage 67 · AdequateInformational 15Details
Commit message · Roman Zeyde

test(core): remove unused imports from unittests

[no changelog]

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit only removes unused Python imports and simplifies a few conditional import blocks in unit test files. It does not change any production firmware code, cryptographic logic, or device behavior. There is no security issue here.

Security candidatefeat(tests, ethereum): add more clear signing fixtures.by PrisionMike · 2d7fcaf1 · Apr 2, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · PrisionMike

feat(tests, ethereum): add more clear signing fixtures.

[no changelog]

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit only adds new test cases and fixes whitespace indentation in a test fixture file for Ethereum transaction signing. It does not change any firmware code that runs on the Trezor device or any production software. The new test cases include edge-case and fuzz-style scenarios (e.g., zero slippage, very large amounts, unknown tokens) to verify how transaction data is displayed to users. There is no security vulnerability introduced here.

Security candidatefix(python): `trezorctl` should use recent THP credentials firstby Roman Zeyde · 280e51fd · Apr 2, 2026 · 2 filesMessage 97 · StrongInformational 24Details
Commit message · Roman Zeyde

fix(python): `trezorctl` should use recent THP credentials first

Otherwise, it may get stuck using an invalidated one (#6575).

97/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validationcredential or privilege state
AI analysis · Informational 24/100

This commit fixes a minor bug in the Trezor command-line tool (trezorctl) used to manage paired device credentials. Previously, when listing saved credentials, the tool would try the oldest saved credential first. If that older credential had been invalidated on the device, the tool could get stuck trying to use it instead of a newer, still-valid one. The fix simply reverses the order so the most recently added credential is tried first. It is a usability/reliability fix rather than a security vulnerability that allows an attacker to steal funds or keys.

Security candidatechore: bump versionsby Ioan Bizău · 851ea3be · Apr 2, 2026 · 9 filesMessage 55 · ThinInformational 15Details
Commit message · Ioan Bizău

chore: bump versions

```
tools/bump-version.py core 2.11.2
tools/bump-version.py secmon 1.0.9
```

[no changelog]

55/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100

This commit only updates version numbers and translation metadata. It changes the firmware version from 2.11.1 to 2.11.2, the security monitor version from 1.0.8 to 1.0.9, and updates the translation files' version headers and signature metadata. There are no code changes that affect security or functionality.

Security candidaterefactor(core): simplify layout-specific `show_intro_backup()`by Roman Zeyde · a7dfcad5 · Apr 2, 2026 · 6 filesMessage 77 · AdequateInformational 15Details
Commit message · Roman Zeyde

refactor(core): simplify layout-specific `show_intro_backup()`

`single_share` parameter can be removed.

[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This is a small internal cleanup in the Trezor firmware's backup setup screens. It removes an unnecessary 'single_share' flag from a function and instead decides which text to show based on whether a word count is provided. There is no visible security change.

Security candidaterefactor(core): move Caesar-specific recovery confirmation layoutby Roman Zeyde · 2facb49f · Mar 31, 2026 · 3 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde

refactor(core): move Caesar-specific recovery confirmation layout

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit is a straightforward code cleanup: it moves a confirmation screen that appears during wallet recovery from one file to another, so the same screen is still shown but in a more appropriate place. There is no security-relevant change.

Security candidatefix: style - after update of black to v26.3.1by M1nd3r · d655442d · Mar 31, 2026 · 19 filesMessage 57 · ThinInformational 15Details
Commit message · M1nd3r

fix: style - after update of black to v26.3.1

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is purely a code-style cleanup triggered by an update to the Python formatter 'black'. It removes unnecessary parentheses around tuple unpacking and adjusts some string-literal formatting. There is no functional change and no security relevance.

Security candidatechore(core): drop trace-level THP loggingby Roman Zeyde · c6749e54 · Mar 30, 2026 · 3 filesMessage 82 · StrongInformational 15Details
Commit message · Roman Zeyde

chore(core): drop trace-level THP logging

This change significantly reduces signing device tests' duration.

[no changelog]

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundarycryptography-sensitive path
AI analysis · Informational 15/100

This commit simply turns off very detailed internal debug logging in the Trezor hardware wallet's core firmware to make automated tests run faster. It does not change any security logic, encryption, or how the device protects secrets. The logging was already only present in debug builds and never exposed sensitive data in production firmware.

Security candidatefix(core): remove MicroPython `math` and complex builtinsby Roman Zeyde · 360fd957 · Mar 27, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde

fix(core): remove MicroPython `math` and complex builtins

Saves ~11 kB of flash.

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit simply turns off two unused MicroPython language features—the math module and complex numbers—to save about 11 kB of flash storage on the Trezor device. There is no indication this fixes a security bug or changes how user funds or secrets are handled.

Security candidatefeat(rust/trezor-thp): secure channel layer: device sideby Martin Milata · db56317e · Mar 26, 2026 · 14 filesMessage 62 · AdequateLow 28Details
Commit message · Martin Milata

feat(rust/trezor-thp): secure channel layer: device side

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 28/100

This commit adds the device-side implementation of a new secure communication layer (THP) for Trezor hardware wallets. It introduces code that handles encrypted channels, pairing handshakes, and legacy protocol fallback. The change is a feature addition rather than a documented security fix, and the diff itself does not show an exploitable vulnerability. However, it is a large, security-critical change to firmware that will protect future host-device communication.

Security candidatefix(core): correct a typo in recovery-related layout function nameby Roman Zeyde · 8ef2caeb · Mar 25, 2026 · 5 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde

fix(core): correct a typo in recovery-related layout function name

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit fixes a spelling mistake in a function name used during wallet recovery on Trezor hardware wallets. The old misspelled name 'show_group_thresholod' is replaced with the correct 'show_group_threshold' across all device layouts. There is no security issue here—just a typo cleanup.

Security candidatefeat(core): Evolu key rotationby Martin Pastyřík · 8807fec0 · Mar 24, 2026 · 57 filesMessage 72 · AdequateLow 37Details
Commit message · Martin Pastyřík

feat(core): Evolu key rotation

Add an index to the generation of Evolu keys and Delegated identity key.

[no changelog]

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Low 37/100

This commit adds a key-rotation feature for the 'Evolu' / 'Suite Sync' delegated identity key used by Trezor. It introduces a rotation index that is mixed into the key derivation, lets users rotate the key on demand, and stores the current index in device storage. The change is a feature addition rather than a fix for an obvious vulnerability, but it touches sensitive key-derivation code and adds new protocol messages.