Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…
Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…
Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.
This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …
This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…
NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…
Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…
Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…
This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…
Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…
This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…
Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.
This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…
This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The chang…
No security-relevant logic changes observedNo input validation changesNo memory safety bug fixes (e.g., no overflow, use-after-free, or uninitialized memory fixes)
This commit is a routine maintenance refactor. MicroPython removed its built-in 'utimeq' module, so Trezor copied the same code into its own firmware tree and renamed it to 'timeq'. There is no security bug being fixed and no new vulnerabi…
This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…
Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. T…
This commit is a straightforward internal code refactor. It adds a small C wrapper file so that Rust code can call two specific internal MicroPython functions that are declared as static/inline in headers. There is no user-facing change, n…
This commit is a routine build-system update for the Trezor firmware. It changes where the build process looks for the MicroPython cross-compiler binary (mpy-cross) and synchronizes a configuration header with newer MicroPython code. There…
This commit updates the Trezor firmware build system to use a newer MicroPython mechanism for tracking special memory pointers called 'root pointers.' It removes hard-coded lists of these pointers from configuration files and instead colle…
GC root pointer handling changedBuild system now auto-collects root pointers instead of hard-coding themRemoves manual MICROPY_PORT_ROOT_POINTERS lists
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedchore(core): pull some translations from Crowdinby obrusvit · f24354b9 · Oct 7, 2025 · 7 filesMessage 57 · ThinTriage 0Details
Commit message · obrusvit
chore(core): pull some translations from Crowdin
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
AI review queuedfeat(core/eckhart): progress copy to use ellipsisby obrusvit · e301c5a6 · Oct 7, 2025 · 8 filesMessage 57 · ThinTriage 0Details
Commit message · obrusvit
feat(core/eckhart): progress copy to use ellipsis
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
AI review queuedfeat(core): notify host about channel replacement [no changelog]by M1nd3r · 8892eee0 · Oct 1, 2025 · 2 filesMessage 77 · AdequateLow 27Details
Commit message · M1nd3r
feat(core): notify host about channel replacement [no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Low 27/100
This commit adds a new device state flag so the Trezor hardware wallet can tell a connected computer: 'this session replaced an existing channel, so the user does not need to confirm again.' The host-side library is updated to recognize the new state. It is a feature change, not an obvious vulnerability fix, but it touches the authentication/authorization boundary between device and host.
AI review queuedchore(core): shorten french stringby obrusvit · bde7f27e · Oct 1, 2025 · 3 filesMessage 57 · ThinInformational 15Details
Commit message · obrusvit
chore(core): shorten french string
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit simply shortens a French translation string used on the device screen. It changes 'Effacer les données de l'appareil' to 'Effacer l'appareil' and updates the corresponding translation signature file and UI test snapshots. There is no code behavior change and no security relevance.
AI review queuedfix(prodtest): Hotfix for invalid Infineon certificate format.by Andrew Kozlik · fda38e88 · Sep 30, 2025 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Andrew Kozlik
fix(prodtest): Hotfix for invalid Infineon certificate format.
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedfix: add progress when requesting extra databy Ioan Bizău · f7239a7f · Sep 29, 2025 · 6 filesMessage 57 · ThinInformational 15Details
Commit message · Ioan Bizău
fix: add progress when requesting extra data
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit only adds on-screen progress indicators to several cryptocurrency signing flows (EOS, Ethereum, Stellar). It does not change any security logic, cryptography, or transaction validation. The large diff is mostly updated test screenshot fingerprints (fixtures.json) because the new progress screens change the device's displayed images during automated UI tests.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
AI review queuedfeat(core/prodtest): Check device certificate chain before storing it.by Andrew Kozlik · b4766692 · Sep 25, 2025 · 2 filesMessage 62 · AdequateTriage 0Details
Commit message · Andrew Kozlik
feat(core/prodtest): Check device certificate chain before storing it.
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedchore(core): sync some Crowdinby obrusvit · 1b8a8002 · Sep 23, 2025 · 8 filesMessage 72 · AdequateInformational 15Details
Commit message · obrusvit
chore(core): sync some Crowdin
- another batch of sync but not complete, these should be mergeable without pain
[no changelog]
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates wording in several language files (Czech, German, Spanish, French, Italian, Portuguese) and refreshes the corresponding digital signature and UI test snapshot records. There are no code logic changes, no security fixes, and no changes to how the device protects private keys or signs transactions.
AI review queuedfix(core): don't raise `ThpError` on low-level protocol errorsby Roman Zeyde · c39a65ab · Sep 22, 2025 · 5 filesMessage 85 · StrongLow 46Details
Commit message · Roman Zeyde
fix(core): don't raise `ThpError` on low-level protocol errors
`ThpError` ends up being sent over the protocol as `MessageType_Failure`, but in case of a low-level problem (e.g. unexpected SEQ bit), it is probably better to ignore the offending message.
We should also not raise `ThpError` when a function is called with invalid arguments (e.g. bit value not being 0 or 1).
[no changelog]
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Low 46/100
This commit changes how the Trezor hardware wallet handles low-level communication errors in its new THP (Trezor Host Protocol) code. Previously, certain malformed or unexpected low-level packets would cause the device to raise a ThpError, which gets sent back to the host as a Failure message. The patch makes the device silently ignore many of these low-level problems instead—such as unexpected control bytes, wrong sequence bits, bad checksums, invalid broadcast lengths, and reassembly overruns. Some internal argument checks are also converted from raising errors to assert statements, which only run in debug builds and are removed in production firmware. The stated intent is to make the protocol more robust against noisy or malformed traffic, but it also reduces the device's visibility into potential attacks or protocol fuzzing.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit simply removes an unused error code named INVALID_DATA from the Trezor hardware wallet's new THP (Trezor Host Protocol) code. It deletes the numeric constant, the matching Python exception class, and the mapping that translated the error number into that exception. There is no change to how data is validated or how errors are handled; it only cleans up code that was never referenced.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine translation update for the Trezor hardware wallet firmware. It adds and updates translated text strings for a new device model called 'Eckhart' across several language files (Czech, German, Spanish, French, Italian, Portuguese). It also updates the digital signature that verifies the translation files and refreshes the expected visual test snapshots because the on-screen text has changed. There is no code that handles secrets, cryptography, or device security logic in this change.
AI review queuedchore(core): Crowdin sync for new Eckhart stringsby obrusvit · e6f18cea · Sep 17, 2025 · 8 filesMessage 57 · ThinInformational 15Details
Commit message · obrusvit
chore(core): Crowdin sync for new Eckhart strings
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine synchronization of translated user-interface text strings for the new 'Eckhart' Trezor device model. It adds and updates translations in Czech, German, Spanish, French, Italian, and Portuguese, plus updates translation signatures and UI test snapshot hashes. There are no code logic changes and no security relevance.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedfix(core): use translation strings for THP layoutsby Roman Zeyde · e68bc306 · Sep 11, 2025 · 7 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde
fix(core): use translation strings for THP layouts
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit replaces hard-coded English text in Trezor's on-screen pairing and connection prompts with proper translation keys. The visible messages stay the same in English, but the firmware can now display them in other languages. There is no security bug being fixed here; it is a routine internationalization cleanup.
AI review queued refactor(core): replace all Union usage by | syntax in core except `core/vendor` [no changelog]by M1nd3r · 60cc5c06 · Sep 9, 2025 · 7 filesMessage 77 · AdequateInformational 15Details
Commit message · M1nd3r
refactor(core): replace all Union usage by | syntax in core except `core/vendor` [no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine code cleanup that replaces older Python type-hint syntax (Union[...]) with the newer pipe syntax (|). It also updates one helper function to return None instead of the string 'dynamic' for consistency. There is no change to program logic, no security fix, and no vulnerability introduced.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI review queuedbuild: migrate to uv, drop poetry everywhereby matejcik · 8a75794d · Sep 8, 2025 · 29 filesMessage 72 · AdequateInformational 15Details
Commit message · matejcik
build: migrate to uv, drop poetry everywhere
except for HWI and ts-tvl that are using it locally
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine build-system housekeeping change for the Trezor firmware repository. It replaces the Python Poetry package manager with the `uv` package manager across CI workflows, build scripts, and documentation. No device firmware code, cryptographic logic, or security-sensitive behavior is modified. The change is purely about how development dependencies are installed and invoked.
AI review queuedfix(translations): shorten some stringsby Ioan Bizău · 50c8a7bf · Sep 3, 2025 · 4 filesMessage 57 · ThinTriage 0Details
Commit message · Ioan Bizău
fix(translations): shorten some strings
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine update of user-facing text translations for the Trezor firmware. It changes wording in multiple languages, adds new translation keys for upcoming features (such as Bluetooth and new device screens), and replaces a non-breaking space with a regular space in a few English strings. There is no code logic change and no security-relevant behavior is altered.
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit changes a build script for Trezor's Nordic (nRF) hardware so it can automatically detect whether it is running inside a Docker/Nix build environment or a local developer's machine, and then run the build command the appropriate way. It is a build-system convenience change with no visible security relevance.
chore(core/eckhart): implement BLE device unpairing
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 21/100
This commit adds the ability for a Trezor hardware wallet to forget (unpair) a specific Bluetooth device by its MAC address, instead of only being able to unpair the currently connected device or all devices. It is a feature-completion change for the new Eckhart model's Bluetooth settings menu. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a routine user-facing feature implementation.