CommitWatch RSS
TZ
← All projectsTrezor

Trezor firmware

Firmware monorepo for Trezor One, Model T, and Safe devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

2661 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

916security candidates311second-pass queue2655AI analyses
336commits · 30 days
588commits · 60 days
1363commits · 180 days
2648commits · 365 days
Backfill bands
Aug 5 → Feb 61298 seen115 candidatesComplete
Feb 6 → Jun 6775 seen58 candidatesComplete
Jun 6 → Jul 6217 seen13 candidatesComplete
Jul 6 → Aug 5360 seen54 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
473Strong · 80–100
1321Adequate · 60–79
862Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
tychovrahe292104292461
Roman Zeyde572177571271
PrisionMike945994273
Andrew Kozlik712470265
obrusvit21376213164
Jakub Janků22919182
Martin Pastyřík23823173
cepetr19682196059
Ioan Bizău23076230059
M1nd3r20671206071
Lukas Bielesch846784067
Martin Milata17446174063
Analysis record

Published AI watches

Last scanned 42 minutes ago

Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove sha1 from regular FW

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…

Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
16d15774by M1nd3r+0−2006 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…

Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
1b3128a4by Ondřej Vejpustek+20−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): change order of parameters

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

33a119eeby Ondřej Vejpustek+15−151 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): prefix enums

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …

f1c74046by Ondřej Vejpustek+26−222 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): prevent calling `memzero(NULL, ...)`

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…

NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
0394e934by Ondřej Vejpustek+11−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): return remote static key from `noise_xxpsk3_*_handle_*()`

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…

Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
3ead1aa6by Ondřej Vejpustek+79−423 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): rename ProjectProfile to ProjectConfig

This commit is a simple rename from 'ProjectProfile' to 'ProjectConfig' in two Rust source files. It only changes variable names, struct names, and error messages. There is no change to program logic, security behavior, or how data is hand…

581b37bcby cepetr+18−182 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): introduce ResolvedBuildArgs

This commit is a straightforward internal code refactor in Trezor's build tooling. It introduces a new ResolvedBuildArgs structure that centralizes default values for command-line build options before they are used. There is no change to u…

c24d1be8by cepetr+99−295 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): make build args tristate

This commit is a straightforward internal refactor of the Trezor firmware build tool's command-line argument handling. It changes many on/off flags from plain booleans to optional booleans so they can explicitly be set to true, false, or l…

271e249aby cepetr+57−561 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): introduce build options

This commit is a straightforward internal code reorganization in Trezor's build tooling. It moves build-option definitions from one Rust source file to a new module and adds the ability to load those options from a configuration file. Ther…

75085e2aby cepetr+275−2007 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce build presets

This commit is a developer tooling change for the Trezor firmware build system. It introduces 'build presets'—named configuration bundles stored in TOML files—so developers can select common build settings with a single command-line flag i…

eefe8f7fby cepetr+397−419 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): upgrade manifest.yaml for tf-tools 0.3.0

This commit is a routine update to a build-system manifest file used by Trezor's internal tooling. It reorganizes and re-labels feature flags (for example, moving options between 'Features', 'Debugging', and 'Signing' groups and simplifyin…

57b28b89by cepetr+86−1351 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add tf-tools 0.3.1+ configuration file

This commit adds a single configuration file for a Trezor developer tool (a VS Code extension). It only points the tool to existing folders in the repository and contains no executable code, no secrets, and no changes to firmware behavior.…

e554f618by cepetr+8−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): rename ResolvedBuild to ResolvedBuildFeatures

This commit is a simple internal code cleanup: it renames a Rust data structure called ResolvedBuild to ResolvedBuildFeatures and updates the places that use it. There are no functional changes, no security fixes, and no changes to how the…

aaa2780bby cepetr+5−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fix up clippy warnings in storage.rs

This is a tiny code cleanup commit that replaces two calls to `ptr::null()` with Rust's `unwrap_or_default()` to silence automated Clippy lint warnings. It does not change what value is produced (still a null pointer when no salt is provid…

62354461by cepetr+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): simplify dependencies

This commit is a straightforward internal code cleanup in Trezor's build tooling. It moves a data structure and two helper methods from one Rust source file to another and updates callers accordingly. There is no change to user-facing beha…

6268349fby cepetr+9−193 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

docs: add xtask documentation

This commit only adds documentation. It updates the table of contents and adds a new markdown page plus a diagram explaining the project's 'xtask' build helper. No code, build scripts, or firmware logic was changed, so it cannot introduce …

4879dababy cepetr+296−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce project-toml build-options

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…

Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
d44de007by cepetr+681−40817 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): fix nightly ARM emulator filename

This commit fixes a filename-renaming step in the project's automated nightly build pipeline. It ensures ARM64 emulator files get the correct name expected by another testing tool. There is no change to the actual Trezor firmware code, dev…

ab95f08fby Martin Milata+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(vendor): avoid micropython submodule noise in git status

This is a routine housekeeping change to reduce clutter in Git's status output for a third-party component (the MicroPython submodule). There is no indication it changes any code that runs on the Trezor device or affects security.

06cab32bby Martin Milata+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidatechore(core): update T3W1 embedded binariesby tychovrahe · a12ecd9a · Aug 11, 2025 · 3 filesMessage 57 · ThinInformational 11Details
Commit message · tychovrahe

chore(core): update T3W1 embedded binaries

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 11/100

This commit swaps out two pre-built binary files for the T3W1 hardware model (a QA bootloader and a Bluetooth firmware blob) and updates the corresponding SHA-256 hashes in a header file. The actual code inside the binaries is not shown, so we cannot tell from this diff alone whether the change fixes a bug, adds a feature, or is purely routine. There is no mention of security in the commit message or any supplied reference.

Security candidaterefactor(core): rewrite debug overlay in rustby tychovrahe · 74c3deaf · Aug 11, 2025 · 30 filesMessage 57 · ThinInformational 19Details
Commit message · tychovrahe

refactor(core): rewrite debug overlay in rust

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 19/100

This commit is a developer-facing refactor that moves the emulator-only debug overlay and screenshot recording logic from Python into Rust. It does not change production firmware behavior; the new features are gated behind debug/emulator build flags and are not present in release builds. There is no obvious security vulnerability introduced, but the change touches low-level display code and removes some old Python APIs.

Security candidaterefactor(core): rename debug overlay to performance overlayby tychovrahe · 98692d54 · Aug 11, 2025 · 13 filesMessage 62 · AdequateInformational 15Details
Commit message · tychovrahe

refactor(core): rename debug overlay to performance overlay

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit is a simple rename from 'debug overlay' to 'performance overlay' across build files and Rust source code. It changes only identifiers, feature flags, and comments; no program logic or security behavior is altered. The overlay remains an optional developer-only feature that is disabled by default.

Security candidatefeat(core): show pairing code in big font in bldby obrusvit · b3ba0063 · Aug 11, 2025 · 4 filesMessage 80 · StrongInformational 15Details
Commit message · obrusvit

feat(core): show pairing code in big font in bld

- introduce new FontInfo for the largest available font (72) which
contains only the numerals, this is used in bootloader for the pairing
code comparison screen

[no changelog]

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
update trustboot or update path
AI analysis · Informational 15/100

This commit is a user-interface improvement for the Trezor hardware wallet bootloader. It makes the Bluetooth pairing code display much larger and easier to read, and spaces out the digits. There is no security vulnerability here; it is purely a usability and accessibility change.

Security candidatefeat(core): render logo on welcome screenby obrusvit · 6e6fe3af · Aug 11, 2025 · 7 filesMessage 72 · AdequateInformational 15Details
Commit message · obrusvit

feat(core): render logo on welcome screen

- also remove unused icons

[no changelog]

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a cosmetic UI change for the Trezor hardware wallet's welcome screen. It replaces the old text-only welcome display with a shared logo-rendering helper and removes two unused icon image files. There is no security-relevant change visible in the code.

Security candidatefeat(core): adjust Eckhart screen borderby obrusvit · b56da395 · Aug 11, 2025 · 12 filesMessage 80 · StrongInformational 15Details
Commit message · obrusvit

feat(core): adjust Eckhart screen border

- render the border 1px from the edge towards center to account for
minor irregularities in display production

[no changelog]

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a cosmetic tweak for the Trezor hardware wallet's screen border. It shifts the decorative border inward by one pixel and updates the corner icons so the line looks evenly thick on different physical screens. There is no security-relevant change here.

Security candidatefeat(core): derive entropy from master keyby cepetr · b8c7822d · Aug 11, 2025 · 45 filesMessage 62 · AdequateLow 32Details
Commit message · cepetr

feat(core): derive entropy from master key

[no changelog]

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
entropy or randomnessseed or entropy pathsigning or wallet pathboot or update path
AI analysis · Low 32/100

This commit changes how some Trezor hardware wallets generate a secret internal 'entropy' value used to protect stored data. For newer devices (STM32U5-based models), the entropy is now derived from a master key already inside the secure chip, using a new 'fw_type' field in the firmware vendor header. For older devices, the previous method using CPU ID and one-time-programmable memory is kept. The change also updates the vendor header format to include a firmware-type byte. There is no direct evidence in the commit of a security vulnerability or fix; it appears to be a design/architecture change.

Security candidatefeat(core): adjust wireless setup QR codeby obrusvit · 24bc11f7 · Aug 11, 2025 · 8 filesMessage 80 · StrongInformational 15Details
Commit message · obrusvit

feat(core): adjust wireless setup QR code

- correct link: https://trezor.io/setup/ts7
- slightly adjusted padding

[no changelog]

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit simply updates the QR code shown during wireless device setup so it points to the correct web link (trezor.io/setup/ts7) and slightly adjusts the surrounding padding. There is no security issue here.

Security candidaterefactor(core): make SLIP-24 UI independent of ETHby Ioan Bizău · db520281 · Aug 7, 2025 · 4 filesMessage 62 · AdequateInformational 17Details
Commit message · Ioan Bizău

refactor(core): make SLIP-24 UI independent of ETH

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 17/100

This commit is a code cleanup that moves the user-confirmation screen for SLIP-24 payment requests out of Ethereum-specific code and into shared UI code. It does not change security checks or add new features; it only reorganizes how account, network, and token details are passed to the display layer. There is no clear security bug in the change itself.

Security candidaterefactor(core): drop outdated Bitcoin SLIP-24 UIby Ioan Bizău · 02741b24 · Aug 7, 2025 · 4 filesMessage 57 · ThinInformational 15Details
Commit message · Ioan Bizău

refactor(core): drop outdated Bitcoin SLIP-24 UI

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 15/100

This commit removes unused user-interface code for displaying Bitcoin payment request details (an old SLIP-24 feature) from four Trezor firmware layout files. It is a cleanup/refactoring change with no security relevance visible in the diff.

Security candidatechore(python): move dev keys from BootloaderV2Image [no changelog]by M1nd3r · a8f976c7 · Aug 7, 2025 · 3 filesMessage 77 · AdequateInformational 18Details
Commit message · M1nd3r

chore(python): move dev keys from BootloaderV2Image
[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
update trustboot or update path
AI analysis · Informational 18/100

This is a code cleanup commit in Trezor's Python firmware tooling. It moves hardcoded developer-only signing keys from one internal file to a shared models file and slightly reorganizes how public keys are looked up. The keys themselves remain in the repository and are still labeled as development keys. There is no indication this fixes a security vulnerability or changes device behavior.

Security candidatefix(core/eckhart): wrong return flow messageby Lukas Bielesch · 86076fa4 · Aug 7, 2025 · 3 filesMessage 57 · ThinLow 35Details
Commit message · Lukas Bielesch

fix(core/eckhart): wrong return flow message

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 35/100

This commit fixes a UI flow bug in the Trezor hardware wallet (Eckhart/T3W1 layout). When a user was setting up a new PIN, opened the menu, chose 'Cancel PIN setup', and then confirmed the cancellation, the device accidentally reported 'success/confirmed' instead of 'cancelled'. This could mislead connected software into thinking the user had approved PIN setup when they actually aborted it.

Security candidatechore(core/eckhart): make hyphen font one level darkerby Lukas Bielesch · 5150074d · Aug 6, 2025 · 2 filesMessage 62 · AdequateInformational 15Details
Commit message · Lukas Bielesch

chore(core/eckhart): make hyphen font one level darker

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit only changes the colors used for text and hyphenation in the user interface of a Trezor hardware wallet theme. It makes some text and hyphen colors slightly darker for visual consistency. There is no security relevance in this change.

Security candidatechore(python): add AUTHORS to python-trezor [no changelog]by M1nd3r · ed214e09 · Aug 6, 2025 · 1 fileMessage 77 · AdequateInformational 15Details
Commit message · M1nd3r

chore(python): add AUTHORS to python-trezor
[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit simply adds two names to the AUTHORS file for the python-trezor package. It is a routine administrative change with no code modifications and no security relevance.

Security candidatechore(python): remove year ranges from license headers [no changelog]by M1nd3r · 902db9a8 · Aug 6, 2025 · 87 filesMessage 77 · AdequateInformational 15Details
Commit message · M1nd3r

chore(python): remove year ranges from license headers
[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 15/100

This commit only updates copyright lines in file headers across many Python files, removing the year ranges (for example, changing '2012-2022' to just 'SatoshiLabs and contributors'). It does not change any program logic, security checks, or behavior. There are no security implications.

Security candidatechore(python): add missing license headers [no changelog]by M1nd3r · 6809ade0 · Aug 6, 2025 · 21 filesMessage 77 · AdequateInformational 15Details
Commit message · M1nd3r

chore(python): add missing license headers
[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
seed or entropy pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 15/100

This commit only adds standard open-source copyright and license notices to the top of 21 Python files. It does not change any program logic, fix bugs, or alter security behavior.