Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…
Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…
Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.
This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …
This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…
NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…
Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
This commit is a simple rename from 'ProjectProfile' to 'ProjectConfig' in two Rust source files. It only changes variable names, struct names, and error messages. There is no change to program logic, security behavior, or how data is hand…
This commit is a straightforward internal code refactor in Trezor's build tooling. It introduces a new ResolvedBuildArgs structure that centralizes default values for command-line build options before they are used. There is no change to u…
This commit is a straightforward internal refactor of the Trezor firmware build tool's command-line argument handling. It changes many on/off flags from plain booleans to optional booleans so they can explicitly be set to true, false, or l…
This commit is a straightforward internal code reorganization in Trezor's build tooling. It moves build-option definitions from one Rust source file to a new module and adds the ability to load those options from a configuration file. Ther…
This commit is a developer tooling change for the Trezor firmware build system. It introduces 'build presets'—named configuration bundles stored in TOML files—so developers can select common build settings with a single command-line flag i…
This commit is a routine update to a build-system manifest file used by Trezor's internal tooling. It reorganizes and re-labels feature flags (for example, moving options between 'Features', 'Debugging', and 'Signing' groups and simplifyin…
This commit adds a single configuration file for a Trezor developer tool (a VS Code extension). It only points the tool to existing folders in the repository and contains no executable code, no secrets, and no changes to firmware behavior.…
This commit is a simple internal code cleanup: it renames a Rust data structure called ResolvedBuild to ResolvedBuildFeatures and updates the places that use it. There are no functional changes, no security fixes, and no changes to how the…
This is a tiny code cleanup commit that replaces two calls to `ptr::null()` with Rust's `unwrap_or_default()` to silence automated Clippy lint warnings. It does not change what value is produced (still a null pointer when no salt is provid…
This commit is a straightforward internal code cleanup in Trezor's build tooling. It moves a data structure and two helper methods from one Rust source file to another and updates callers accordingly. There is no change to user-facing beha…
This commit only adds documentation. It updates the table of contents and adds a new markdown page plus a diagram explaining the project's 'xtask' build helper. No code, build scripts, or firmware logic was changed, so it cannot introduce …
This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…
Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
This commit fixes a filename-renaming step in the project's automated nightly build pipeline. It ensures ARM64 emulator files get the correct name expected by another testing tool. There is no change to the actual Trezor firmware code, dev…
This is a routine housekeeping change to reduce clutter in Git's status output for a third-party component (the MicroPython submodule). There is no indication it changes any code that runs on the Trezor device or affects security.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update path
AI analysis · Informational 17/100
This commit changes how the Trezor firmware build system handles source-line information in its embedded MicroPython interpreter. Previously, enabling or disabling source-line data required rebuilding the MicroPython cross-compiler. After this change, the same compiler binary can include or omit source lines via a command-line flag. This is a build-system convenience and optimization; it does not fix a vulnerability in user-facing code.
build(core): exclude `storage.cache_codec` from THP builds
THP PYOPT=1 builds don't need it.
THP PYOPT=0 builds need DebugLink functionality, but don't use `CodecContext`'s cache-related methods.
Reduces THP build flash usage by ~1kB.
[no changelog]
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 18/100
This is a build-system cleanup for Trezor firmware. It removes an unused storage cache module from a specific firmware variant (THP builds) to save about 1 kB of flash space. The code change also makes sure that when the module is excluded, the few functions that relied on it are skipped too. There is no direct security bug here, but any build-system change that alters which code is compiled into a hardware wallet deserves a quick sanity check.
- fix incorrectly placed connection indicator in some cases - slightly align the label
[no changelog]
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100
This commit fixes visual alignment of icons and text on the Trezor hardware wallet's homescreen for the Eckhart layout. It adjusts where the connection indicator and device label are drawn so they line up correctly with the battery icon. There is no security relevance in this change.
Eckhart should not have cancel option as a 'x' on the action bar but should instead be an option in the menu, like Delizia.
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100
This is a user-interface consistency patch for the Trezor hardware wallet's 'Eckhart' design. It moves the 'cancel' option from a small 'X' button on the action bar into a menu, matching how the newer 'Delizia' design already works. There is no security bug being fixed here; it is purely a layout and navigation change.
chore(eckhart, ui): make warning style for footer optional
- Warning_footer is not "footer" + "is_footer_warning" - Changes had to be propagated across other layouts for commonality.
[no changelog]
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 19/100
This is a routine user-interface refactor for the Trezor hardware wallet firmware. It renames a parameter from 'warning_footer' to 'footer' and allows the footer text to be shown either as a warning (red/alert style) or as a normal informational hint. The change touches many UI test snapshots because screen layouts changed slightly, but there is no evidence of a security vulnerability or fix.
Security candidatefix(style): update C-style to be compliant with clang-format 21.1.8by M1nd3r · 8bdfe004 · Apr 9, 2026 · 67 filesMessage 77 · AdequateInformational 15Details
Commit message · M1nd3r
fix(style): update C-style to be compliant with clang-format 21.1.8
- previous clang-format version was 17.0.6
[no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathboot or update path
AI analysis · Informational 15/100
This commit is purely a code-style cleanup. It updates the project's C source files so they match the formatting rules of a newer version of the clang-format tool (version 21.1.8 instead of 17.0.6). The changes are limited to whitespace, line breaks, comment placement, and how macros and attributes are laid out. No program logic, security checks, or behavior were changed.
chore(layout): make `verb_info` optional in `confirm_with_info`
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100
This is a routine user-interface cleanup change. It makes one button label parameter optional across several Trezor device layouts and updates the Python helper that calls it. There is no security-relevant behavior change: the same screens are shown, only the internal plumbing for deciding whether to display an extra 'info' button is simplified.
- Added Vault deposit flow. - Tests WIP. - changelog will be added after all 4 vault flows are done.
[no changelog]
82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 12/100
This commit adds a new user-facing feature to Trezor hardware wallets: clear signing support for ERC-4626 'vault deposit' transactions on Ethereum. It introduces code that recognizes a specific smart-contract function call, shows the user a friendly confirmation screen with the vault name and deposit amount, and only proceeds if safety checks pass. There is no indication in the commit that this fixes a security bug; it appears to be a normal feature addition.
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathauthentication pathparser or protocol pathdocumentation-only discount
AI analysis · Informational 15/100
This commit is purely a documentation update for the Trezor firmware repository. It reorganizes existing documentation, adds new documentation for the Trezor-Host Protocol (THP), and moves Bitcoin signing and protocol v1 docs to new locations. No executable code, firmware logic, or security-sensitive behavior was changed.
Will be used to allow choosing 2 options (instead of 3). In that case, the 2nd separator should not be rendered.
[no changelog]
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 18/100
This commit is a small UI layout change for the Trezor hardware wallet. It lets a screen that normally shows three word choices display only two choices by leaving one slot blank and hiding the separator line next to it. There is no indication this fixes a security bug; it appears to be a feature tweak for a future user interface.
Security candidatetest(core): test backup cancellation during `ResetDevice`by Roman Zeyde · c72a83e8 · Apr 7, 2026 · 3 filesMessage 87 · StrongInformational 15Details
Commit message · Roman Zeyde
test(core): test backup cancellation during `ResetDevice`
Previously, backup cancellation was tested only during `BackupDevice`.
[no changelog]
87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit only adds new automated tests that simulate a user cancelling the backup step during device setup (ResetDevice). It does not change the actual Trezor firmware code, wallet logic, or fix any bug. It is a testing improvement with no direct security impact on shipped devices.
fix(translations,cardano): translations for credentials phrase in cardano
- Refactored some TR string for better l10n. - Minor code adjustment around it.
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
credential or privilege statesigning or wallet path
AI analysis · Informational 15/100
This commit is a routine translation and user-interface wording update for the Cardano cryptocurrency flow on Trezor hardware wallets. It rephrases on-screen labels such as changing 'key hash' to 'Key hash' and replacing some message-signing prompts with a new credential description template. There is no indication of a security vulnerability being fixed or introduced.
Extract context setup/teardown into `TestCaseWithContext`.
[no changelog]
82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a test-code cleanup only. It moves repeated setup and teardown code for unit tests into a shared helper class, TestCaseWithContext. There are no changes to the actual firmware, wallet logic, cryptography, or any code that runs on a real Trezor device. It cannot affect user funds, device security, or real-world attacks.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit only removes unused Python imports and simplifies a few conditional import blocks in unit test files. It does not change any production firmware code, cryptographic logic, or device behavior. There is no security issue here.
feat(tests, ethereum): add more clear signing fixtures.
[no changelog]
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100
This commit only adds new test cases and fixes whitespace indentation in a test fixture file for Ethereum transaction signing. It does not change any firmware code that runs on the Trezor device or any production software. The new test cases include edge-case and fuzz-style scenarios (e.g., zero slippage, very large amounts, unknown tokens) to verify how transaction data is displayed to users. There is no security vulnerability introduced here.
Security candidatefix(python): `trezorctl` should use recent THP credentials firstby Roman Zeyde · 280e51fd · Apr 2, 2026 · 2 filesMessage 97 · StrongInformational 24Details
Commit message · Roman Zeyde
fix(python): `trezorctl` should use recent THP credentials first
Otherwise, it may get stuck using an invalidated one (#6575).
97/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validationcredential or privilege state
AI analysis · Informational 24/100
This commit fixes a minor bug in the Trezor command-line tool (trezorctl) used to manage paired device credentials. Previously, when listing saved credentials, the tool would try the oldest saved credential first. If that older credential had been invalidated on the device, the tool could get stuck trying to use it instead of a newer, still-valid one. The fix simply reverses the order so the most recently added credential is tried first. It is a usability/reliability fix rather than a security vulnerability that allows an attacker to steal funds or keys.
✓ Subject identifies a change✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100
This commit only updates version numbers and translation metadata. It changes the firmware version from 2.11.1 to 2.11.2, the security monitor version from 1.0.8 to 1.0.9, and updates the translation files' version headers and signature metadata. There are no code changes that affect security or functionality.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This is a small internal cleanup in the Trezor firmware's backup setup screens. It removes an unnecessary 'single_share' flag from a function and instead decides which text to show based on whether a word count is provided. There is no visible security change.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit is a straightforward code cleanup: it moves a confirmation screen that appears during wallet recovery from one file to another, so the same screen is still shown but in a more appropriate place. There is no security-relevant change.
Security candidatefix: style - after update of black to v26.3.1by M1nd3r · d655442d · Mar 31, 2026 · 19 filesMessage 57 · ThinInformational 15Details
Commit message · M1nd3r
fix: style - after update of black to v26.3.1
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100
This commit is purely a code-style cleanup triggered by an update to the Python formatter 'black'. It removes unnecessary parentheses around tuple unpacking and adjusts some string-literal formatting. There is no functional change and no security relevance.
Security candidatechore(core): drop trace-level THP loggingby Roman Zeyde · c6749e54 · Mar 30, 2026 · 3 filesMessage 82 · StrongInformational 15Details
Commit message · Roman Zeyde
chore(core): drop trace-level THP logging
This change significantly reduces signing device tests' duration.
[no changelog]
82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundarycryptography-sensitive path
AI analysis · Informational 15/100
This commit simply turns off very detailed internal debug logging in the Trezor hardware wallet's core firmware to make automated tests run faster. It does not change any security logic, encryption, or how the device protects secrets. The logging was already only present in debug builds and never exposed sensitive data in production firmware.
Security candidatefix(core): remove MicroPython `math` and complex builtinsby Roman Zeyde · 360fd957 · Mar 27, 2026 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde
fix(core): remove MicroPython `math` and complex builtins
Saves ~11 kB of flash.
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100
This commit simply turns off two unused MicroPython language features—the math module and complex numbers—to save about 11 kB of flash storage on the Trezor device. There is no indication this fixes a security bug or changes how user funds or secrets are handled.
feat(rust/trezor-thp): secure channel layer: device side
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 28/100
This commit adds the device-side implementation of a new secure communication layer (THP) for Trezor hardware wallets. It introduces code that handles encrypted channels, pairing handshakes, and legacy protocol fallback. The change is a feature addition rather than a documented security fix, and the diff itself does not show an exploitable vulnerability. However, it is a large, security-critical change to firmware that will protect future host-device communication.
Security candidatefix(core): correct a typo in recovery-related layout function nameby Roman Zeyde · 8ef2caeb · Mar 25, 2026 · 5 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde
fix(core): correct a typo in recovery-related layout function name
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100
This commit fixes a spelling mistake in a function name used during wallet recovery on Trezor hardware wallets. The old misspelled name 'show_group_thresholod' is replaced with the correct 'show_group_threshold' across all device layouts. There is no security issue here—just a typo cleanup.
Security candidatefeat(core): Evolu key rotationby Martin Pastyřík · 8807fec0 · Mar 24, 2026 · 57 filesMessage 72 · AdequateLow 37Details
Commit message · Martin Pastyřík
feat(core): Evolu key rotation
Add an index to the generation of Evolu keys and Delegated identity key.
[no changelog]
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Low 37/100
This commit adds a key-rotation feature for the 'Evolu' / 'Suite Sync' delegated identity key used by Trezor. It introduces a rotation index that is mixed into the key derivation, lets users rotate the key on demand, and stores the current index in device storage. The change is a feature addition rather than a fix for an obvious vulnerability, but it touches sensitive key-derivation code and adds new protocol messages.