Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…
Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…
Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.
This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …
This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…
NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…
Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…
This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…
Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…
This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…
Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.
This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…
This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The chang…
No security-relevant logic changes observedNo input validation changesNo memory safety bug fixes (e.g., no overflow, use-after-free, or uninitialized memory fixes)
This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…
Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. T…
This commit is a large but purely mechanical code cleanup: it replaces the custom STATIC macro with the standard C keyword static across many MicroPython module files. There is no change to program logic, security boundaries, or behavior. …
This commit is a routine code cleanup that updates Trezor firmware to match a newer MicroPython version where built-in module names dropped the 'u' prefix (for example, 'uos' became 'os' and 'ustruct' became 'struct'). It renames imports, …
This commit only updates the firmware version number from 2.12.4 to 2.12.5 in the source code and translation files. It does not change any security-related logic, fix any bug, or alter any cryptographic behavior. It is a routine release b…
This is a routine build-system cleanup for the Trezor firmware. It switches the internal 'trezor_lib' Rust crate to be built with the project's own 'xbuild' tool, removes transitional feature flags, and reorganizes Cargo.toml files. There …
This commit adds Bluetooth Low Energy (BLE) support for the Trezor T3T2 hardware model. It introduces new board configuration files, pin mappings, build scripts, and firmware binaries for the Nordic nRF54LS05A BLE radio used in T3T2. There…
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedtest(core): drop `test_descriptor_all_formatters` unit testby Roman Zeyde · 3704e769 · Jul 1, 2026 · 1 fileMessage 87 · StrongTriage 12Details
Commit message · Roman Zeyde
test(core): drop `test_descriptor_all_formatters` unit test
It should be covered by device tests.
[no changelog]
87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
AI review queuedchore(tron): scaffolding for `WithdrawBalanceContract`by PrisionMike · 2b93024e · Jun 29, 2026 · 18 filesMessage 62 · AdequateTriage 12Details
Commit message · PrisionMike
chore(tron): scaffolding for `WithdrawBalanceContract`
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedrefactor(core): close other workflows when starting `ProgressLayout`by Roman Zeyde · ada6a447 · Jun 26, 2026 · 4 filesMessage 62 · AdequateTriage 12Details
Commit message · Roman Zeyde
refactor(core): close other workflows when starting `ProgressLayout`
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedfix(solana): show the program id for unknown programs in the tx details view instead of a generic "Unsupported program" label.by Sammy Harris · 7ea33494 · Jun 25, 2026 · 4 filesMessage 77 · AdequateTriage 12Details
Commit message · Sammy Harris
fix(solana): show the program id for unknown programs in the tx details view instead of a generic "Unsupported program" label.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedfix(solana): use template for indexed cosigners [no changelog]by Michal Kazda · 4c25a6fd · Jun 21, 2026 · 7 filesMessage 77 · AdequateTriage 12Details
Commit message · Michal Kazda
fix(solana): use template for indexed cosigners [no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedchore(translations): upload signed translationsby PrisionMike · 67cc06e2 · Jun 18, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · PrisionMike
chore(translations): upload signed translations
(cherry picked from commit 7d7eb296412dc993f78976fe7f41dcf80d50019b)
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
AI review queuedchore: add hardcoded 1inch definitionsby Ioan Bizău · 730cbd94 · Jun 15, 2026 · 2 filesMessage 80 · StrongTriage 12Details
Commit message · Ioan Bizău
chore: add hardcoded 1inch definitions
This reverts commit dc1f3a1b4d81900ab0a406617f5efb7e200df14e but adds more definitions that what was there.
[no changelog]
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedchore: tweak hardcoded LiFi definitionsby Ioan Bizău · 9ad5fa49 · Jun 15, 2026 · 1 fileMessage 57 · ThinTriage 12Details
Commit message · Ioan Bizău
chore: tweak hardcoded LiFi definitions
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedfix(python): skip stale protocol v1 responsesby Roman Zeyde · 1edb54ac · Jun 12, 2026 · 4 filesMessage 57 · ThinTriage 7Details
Commit message · Roman Zeyde
fix(python): skip stale protocol v1 responses
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedchore(rust): remove unneeded `script_type` from Trezor::get_public_key()by Roman Zeyde · a87197ed · Jun 8, 2026 · 4 filesMessage 62 · AdequateTriage 12Details
Commit message · Roman Zeyde
chore(rust): remove unneeded `script_type` from Trezor::get_public_key()
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedrefactor(core/build): stop treating emulator as a separate HW board, instead use it to emulate the selected boardby tychovrahe · 566dc7db · Jun 8, 2026 · 22 filesMessage 62 · AdequateTriage 0Details
Commit message · tychovrahe
refactor(core/build): stop treating emulator as a separate HW board, instead use it to emulate the selected board
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedfeat(core/build): add board and target configuration filesby tychovrahe · 9bf8a898 · Jun 8, 2026 · 23 filesMessage 62 · AdequateTriage 0Details
Commit message · tychovrahe
feat(core/build): add board and target configuration files
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedfix(core/cardano): don't access TR in global ctxby copilot-swe-agent[bot] · 9365fb01 · Jun 3, 2026 · 6 filesMessage 57 · ThinTriage 12Details
Commit message · copilot-swe-agent[bot]
fix(core/cardano): don't access TR in global ctx
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queueddocs(core): document why `_waiting_screen` doesn't send ButtonRequestsby Roman Zeyde · 4fa4371a · Jun 3, 2026 · 1 fileMessage 74 · AdequateTriage 7Details
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Explains rationale or failure mode! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedfix(core): avoid failing ButtonRequest handling at `ContinueOnErrors`by Roman Zeyde · f12deee6 · Jun 3, 2026 · 3 filesMessage 85 · StrongTriage 7Details
Commit message · Roman Zeyde
fix(core): avoid failing ButtonRequest handling at `ContinueOnErrors`
No more button requests / errors will be sent later during the backup workflow after an I/O-related error/timeout.
Host will be ignored until the backup workflow is over - sending the final "Success" response may fail.
Other workflows can be aborted after user cancellation via `_waiting_screen()`.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedchore(core): update communication-related stringsby Roman Zeyde · ef194b4a · Jun 2, 2026 · 7 filesMessage 57 · ThinTriage 12Details
Commit message · Roman Zeyde
chore(core): update communication-related strings
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedchore(deps): bump urllib3 in /tools/automatic_battery_testerby dependabot[bot] · 2bda8865 · May 29, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]
chore(deps): bump urllib3 in /tools/automatic_battery_tester
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI review queuedfix(core): skip bitcoin.signtx_decred test on BTC_ONLYby M1nd3r · 80c9f204 · May 29, 2026 · 1 fileMessage 72 · AdequateTriage 12Details
Commit message · M1nd3r
fix(core): skip bitcoin.signtx_decred test on BTC_ONLY
[no changelog]
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedtest(solana): sign message with many cosignersby Jakub Janků · e0b2dea3 · May 29, 2026 · 2 filesMessage 67 · AdequateTriage 12Details
Commit message · Jakub Janků
test(solana): sign message with many cosigners
67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedchore(ci): skip `auto-assign` job for botsby M1nd3r · c784179b · May 29, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · M1nd3r
chore(ci): skip `auto-assign` job for bots
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: security-sensitive path
AI review queuedfix(core): fix device_menu crash on devices without a serial numberby cepetr · 51790381 · May 29, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · cepetr
fix(core): fix device_menu crash on devices without a serial number
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedchore(core): adjust json vendorheadersby M1nd3r · 82f1c71b · May 27, 2026 · 14 filesMessage 57 · ThinTriage 12Details
Commit message · M1nd3r
chore(core): adjust json vendorheaders
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path