CommitWatch RSS
TZ
← All projectsTrezor

Trezor firmware

Firmware monorepo for Trezor One, Model T, and Safe devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

2656 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

916security candidates311second-pass queue1244AI analyses
343commits · 30 days
583commits · 60 days
1358commits · 180 days
2651commits · 365 days
Backfill bands
Aug 5 → Feb 61298 seen115 candidatesComplete
Feb 6 → Jun 6775 seen58 candidatesComplete
Jun 6 → Jul 6217 seen13 candidatesComplete
Jul 6 → Aug 5360 seen54 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
473Strong · 80–100
1318Adequate · 60–79
860Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
PrisionMike945978273
Andrew Kozlik712431265
Roman Zeyde571177243171
tychovrahe292104120161
Jakub Janků19915184
Martin Pastyřík23810173
cepetr19682101059
Ioan Bizău23076140059
obrusvit21376105064
M1nd3r2067184071
Lukas Bielesch846771067
Martin Milata1744655063
Analysis record

Published AI watches

Last scanned 41 minutes ago

Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove sha1 from regular FW

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…

Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
16d15774by M1nd3r+0−2006 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…

Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
1b3128a4by Ondřej Vejpustek+20−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): change order of parameters

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

33a119eeby Ondřej Vejpustek+15−151 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): prefix enums

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …

f1c74046by Ondřej Vejpustek+26−222 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): prevent calling `memzero(NULL, ...)`

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…

NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
0394e934by Ondřej Vejpustek+11−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): return remote static key from `noise_xxpsk3_*_handle_*()`

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…

Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
3ead1aa6by Ondřej Vejpustek+79−423 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): rename ProjectProfile to ProjectConfig

This commit is a simple rename from 'ProjectProfile' to 'ProjectConfig' in two Rust source files. It only changes variable names, struct names, and error messages. There is no change to program logic, security behavior, or how data is hand…

581b37bcby cepetr+18−182 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): introduce ResolvedBuildArgs

This commit is a straightforward internal code refactor in Trezor's build tooling. It introduces a new ResolvedBuildArgs structure that centralizes default values for command-line build options before they are used. There is no change to u…

c24d1be8by cepetr+99−295 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): make build args tristate

This commit is a straightforward internal refactor of the Trezor firmware build tool's command-line argument handling. It changes many on/off flags from plain booleans to optional booleans so they can explicitly be set to true, false, or l…

271e249aby cepetr+57−561 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): introduce build options

This commit is a straightforward internal code reorganization in Trezor's build tooling. It moves build-option definitions from one Rust source file to a new module and adds the ability to load those options from a configuration file. Ther…

75085e2aby cepetr+275−2007 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce build presets

This commit is a developer tooling change for the Trezor firmware build system. It introduces 'build presets'—named configuration bundles stored in TOML files—so developers can select common build settings with a single command-line flag i…

eefe8f7fby cepetr+397−419 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): upgrade manifest.yaml for tf-tools 0.3.0

This commit is a routine update to a build-system manifest file used by Trezor's internal tooling. It reorganizes and re-labels feature flags (for example, moving options between 'Features', 'Debugging', and 'Signing' groups and simplifyin…

57b28b89by cepetr+86−1351 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): add tf-tools 0.3.1+ configuration file

This commit adds a single configuration file for a Trezor developer tool (a VS Code extension). It only points the tool to existing folders in the repository and contains no executable code, no secrets, and no changes to firmware behavior.…

e554f618by cepetr+8−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): rename ResolvedBuild to ResolvedBuildFeatures

This commit is a simple internal code cleanup: it renames a Rust data structure called ResolvedBuild to ResolvedBuildFeatures and updates the places that use it. There are no functional changes, no security fixes, and no changes to how the…

aaa2780bby cepetr+5−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): fix up clippy warnings in storage.rs

This is a tiny code cleanup commit that replaces two calls to `ptr::null()` with Rust's `unwrap_or_default()` to silence automated Clippy lint warnings. It does not change what value is produced (still a null pointer when no salt is provid…

62354461by cepetr+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(xtask): simplify dependencies

This commit is a straightforward internal code cleanup in Trezor's build tooling. It moves a data structure and two helper methods from one Rust source file to another and updates callers accordingly. There is no change to user-facing beha…

6268349fby cepetr+9−193 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

docs: add xtask documentation

This commit only adds documentation. It updates the table of contents and adds a new markdown page plus a diagram explaining the project's 'xtask' build helper. No code, build scripts, or firmware logic was changed, so it cannot introduce …

4879dababy cepetr+296−03 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce project-toml build-options

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…

Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
d44de007by cepetr+681−40817 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

ci(core): fix nightly ARM emulator filename

This commit fixes a filename-renaming step in the project's automated nightly build pipeline. It ensures ARM64 emulator files get the correct name expected by another testing tool. There is no change to the actual Trezor firmware code, dev…

ab95f08fby Martin Milata+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(vendor): avoid micropython submodule noise in git status

This is a routine housekeeping change to reduce clutter in Git's status output for a third-party component (the MicroPython submodule). There is no indication it changes any code that runs on the Trezor device or affects security.

06cab32bby Martin Milata+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedfeat(core): SLIP-24 payment requests for Cardanoby Ioan Bizău · 218805d2 · Aug 13, 2025 · 13 filesMessage 57 · ThinLow 35Details
Commit message · Ioan Bizău

feat(core): SLIP-24 payment requests for Cardano

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 35/100

This commit adds a new feature to Trezor hardware wallets: SLIP-24 payment requests for Cardano transactions. It lets a merchant or service provider attach a signed payment request to a Cardano transaction, which the device then displays to the user for confirmation. The change is a feature addition, not a documented security fix. It includes a restriction that payment requests can only be used with single-output transactions, and it reuses an existing payment-request verification framework already present in the firmware.

AI review queuedchore(core): regen foreign charsby obrusvit · b7fb51a7 · Aug 12, 2025 · 11 filesMessage 57 · ThinInformational 15Details
Commit message · obrusvit

chore(core): regen foreign chars

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine translation and font maintenance update. It regenerates Spanish and Portuguese font glyph data for the 'º' character, updates translation string files, refreshes the translation signature, and updates UI test fixture hashes. There is no code that handles secrets, cryptography, network data, or user authorization, and nothing in the commit suggests a security fix or vulnerability.

AI review queuedchore(core): remove logging from `alternating_bit_protocol`by Roman Zeyde · 4b9deb7b · Aug 12, 2025 · 1 fileMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde

chore(core): remove logging from `alternating_bit_protocol`

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply removes debug-only logging statements from a low-level Trezor firmware communication helper. There is no change to actual device behavior, no security fix, and no vulnerability introduced.

AI review queuedfix(core): reset primask in emergency rescueby tychovrahe · 4aa64d88 · Aug 11, 2025 · 1 fileMessage 80 · StrongLow 41Details
Commit message · tychovrahe

fix(core): reset primask in emergency rescue

This allows RSOD to work properly in case the crash occurs in critical sections with interrupts disabled via primask

[no changelog]

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Low 41/100

This commit fixes a low-level crash-recovery bug in Trezor hardware wallets. If the device crashed while interrupts were temporarily disabled (a common protective state during sensitive operations), the emergency rescue code could fail to re-enable normal interrupts before showing the Red Screen of Death (RSOD). The fix adds one line to re-enable interrupts so the recovery screen works reliably. There is no direct evidence this is exploitable as an attack; it is primarily a reliability/resilience fix.

AI review queuedchore(translations): normalize strings to NFC not NFKCby matejcik · 41f60722 · Aug 8, 2025 · 56 filesMessage 62 · AdequateInformational 19Details
Commit message · matejcik

chore(translations): normalize strings to NFC not NFKC

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit changes how special characters in translated text are normalized (converted to a standard form) from a stricter method (NFKC) to a less strict one (NFC). It also adds the masculine ordinal indicator (º) to Spanish and Portuguese font glyph sets and updates many translation strings and test snapshots. The change is a routine internationalization/translation tooling fix. There is no direct evidence in the commit that this fixes an active security vulnerability.

AI review queuedfeat(core): SLIP-24 UI for Rippleby Ioan Bizău · 04adf71f · Aug 8, 2025 · 5 filesMessage 57 · ThinInformational 20Details
Commit message · Ioan Bizău

feat(core): SLIP-24 UI for Ripple

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 20/100

This commit adds a new on-screen confirmation flow for Ripple payment requests on newer Trezor hardware wallets. It replaces a placeholder TODO with a proper user-interface that shows the recipient, memos, refund details, and trade details before signing. There is no obvious security bug in the change; it is a feature implementation that improves transparency for users.

AI review queuedfeat(core): use new SLIP-24 UI for Bitcoinby Ioan Bizău · c27dba5a · Aug 7, 2025 · 5 filesMessage 57 · ThinInformational 15Details
Commit message · Ioan Bizău

feat(core): use new SLIP-24 UI for Bitcoin

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit updates the on-screen user interface shown when approving Bitcoin payment requests on a Trezor device. It replaces an older screen that merely asked whether to show details with a new screen that actually displays the payment request details (recipient, address, memos, refunds, trades, account path). There is no indication of a security bug or vulnerability fix in the change itself or the commit message.

AI review queuedfeat(tests): SLIP-24 tests for Bitcoinby Ioan Bizău · 8805f9ca · Aug 7, 2025 · 2 filesMessage 90 · StrongInformational 15Details
Commit message · Ioan Bizău

feat(tests): SLIP-24 tests for Bitcoin

* replace Dash and GRS with some coins that we still support
* drop unnecessary input flow (since we will now visit all menus by
default)
* add a test for the most basic use case: Swap with refund address and
extra message
* run tests on all current models

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes test files for Trezor hardware wallet firmware. It updates which cryptocurrencies are used in automated tests, adds a new test case for a basic swap scenario, removes an outdated manual input-flow test, and adjusts which device models certain tests run on. There are no changes to the actual wallet firmware code that users rely on, so this cannot directly affect device security.

AI review queuedfix(core): allow text details memos in Bitcoinby Ioan Bizău · e3e2b8cf · Aug 7, 2025 · 1 fileMessage 57 · ThinLow 38Details
Commit message · Ioan Bizău

fix(core): allow text details memos in Bitcoin

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 38/100

This commit fixes a validation check in the Trezor hardware wallet's Bitcoin signing code. The device accepts 'payment request memos' that can contain different memo types, and it should reject requests where more than one type is set at once. A newly added memo type ('text details memo') was accidentally left out of the 'pick exactly one' check, so a malicious or buggy host could potentially include both a text memo and a text-details memo in the same payment request, confusing what the user sees or breaking an invariant the firmware relies on.

AI review queuedfix(core): skip unexpected THP packet during channel allocationby Roman Zeyde · 191631fb · Aug 6, 2025 · 1 fileMessage 62 · AdequateLow 28Details
Commit message · Roman Zeyde

fix(core): skip unexpected THP packet during channel allocation

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Low 28/100

This commit changes the Trezor host-side Python library so that when it tries to open a new communication channel with a Trezor device, it can ignore up to 50 unexpected packets before giving up. Previously, a single stray or delayed packet would cause the channel setup to fail. The change makes the connection process more tolerant of leftover traffic, which could happen during retransmissions or after a previous session.

AI review queuedchore(core): use non-breakable space between value and unitby Lukas Bielesch · 6e2d44d7 · Aug 6, 2025 · 28 filesMessage 62 · AdequateInformational 15Details
Commit message · Lukas Bielesch

chore(core): use non-breakable space between value and unit

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a cosmetic user-interface change. It replaces ordinary spaces with non-breaking spaces between numbers and their units (for example, showing '1.23 BTC' with a special space that prevents the number and 'BTC' from being split across two lines on the Trezor screen). There is no security-relevant behavior change.