Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…
Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…
Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.
This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …
This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…
NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…
Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…
Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…
This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…
Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…
This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…
Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.
This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…
This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The chang…
No security-relevant logic changes observedNo input validation changesNo memory safety bug fixes (e.g., no overflow, use-after-free, or uninitialized memory fixes)
This commit is a routine maintenance refactor. MicroPython removed its built-in 'utimeq' module, so Trezor copied the same code into its own firmware tree and renamed it to 'timeq'. There is no security bug being fixed and no new vulnerabi…
This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…
Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. T…
This commit is a straightforward internal code refactor. It adds a small C wrapper file so that Rust code can call two specific internal MicroPython functions that are declared as static/inline in headers. There is no user-facing change, n…
This commit is a routine build-system update for the Trezor firmware. It changes where the build process looks for the MicroPython cross-compiler binary (mpy-cross) and synchronizes a configuration header with newer MicroPython code. There…
This commit updates the Trezor firmware build system to use a newer MicroPython mechanism for tracking special memory pointers called 'root pointers.' It removes hard-coded lists of these pointers from configuration files and instead colle…
GC root pointer handling changedBuild system now auto-collects root pointers instead of hard-coding themRemoves manual MICROPY_PORT_ROOT_POINTERS lists
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedrefactor: stellar confirmationsby Ioan Bizău · 663569c4 · Mar 19, 2026 · 4 filesMessage 62 · AdequateLow 32Details
Commit message · Ioan Bizău
refactor: stellar confirmations
[no changelog]
(cherry picked from commit a7f5e7200f49b390c65940638900f071258207b4)
62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 32/100
This commit refactors how Trezor handles Stellar cryptocurrency transaction confirmations when a 'payment request' is used. Previously, the device might skip confirming individual operations during payment requests. The change ensures that only simple payment operations are allowed in payment requests, rejects invalid operation types, and still requires user confirmation. It also adds a test case for an invalid operation in a payment request. The commit appears to be a defensive hardening change rather than a fix for an active exploit.
AI review queuedchore(translations): updated fixtures [no changelog]by Michal Kazda · 98f526da · Mar 17, 2026 · 3 filesMessage 77 · AdequateInformational 15Details
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine maintenance update for translation files and test snapshots. It changes one Spanish tutorial sentence to be clearer, updates the cryptographic signature metadata for the translation files, and refreshes many expected visual-test hashes. There is no code that runs on the device or handles secrets, and nothing in the commit suggests a security fix or vulnerability.
AI review queuedfix(python): use `node.fingerprint` to support older FWby Roman Zeyde · 0c12c0f4 · Mar 13, 2026 · 3 filesMessage 85 · StrongTriage 7Details
Commit message · Roman Zeyde
fix(python): use `node.fingerprint` to support older FW
`PublicKey.root_fingerprint` support was added in: ``` * 5728f54b78 Pavol Rusnak: core: return root_fingerprint in PublicKey (5 years ago) * 4d45a68fd0 Pavol Rusnak: legacy: return root_fingerprint in PublicKey (5 years ago) ```
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedfeat(tron): Add support for `VoteWitnessContract` - scaffoldingby PrisionMike · 713a3454 · Mar 10, 2026 · 20 filesMessage 62 · AdequateInformational 15Details
Commit message · PrisionMike
feat(tron): Add support for `VoteWitnessContract` - scaffolding
Tron Voting. Gen code.
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds the initial protocol and code-generation scaffolding for a new Tron blockchain feature: voting for Super Representatives (called VoteWitnessContract). It defines the new message types in protobuf, regenerates the corresponding Python and Rust message bindings, adds translation strings, and includes test fixtures. It does not contain the actual firmware logic that would parse, validate, display, or sign these votes, so there is no directly exploitable security issue in this patch alone.
AI review queuedchore(deps): bump static-alloc from 0.2.4 to 0.2.6 in /core/embed/rustby dependabot[bot] · cdee99da · Mar 2, 2026 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]
chore(deps): bump static-alloc from 0.2.4 to 0.2.6 in /core/embed/rust
Bumps [static-alloc](https://github.com/197g/static-alloc) from 0.2.4 to 0.2.6. - [Changelog](https://github.com/197g/static-alloc/blob/master/release_checks) - [Commits](https://github.com/197g/static-alloc/commits)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI review queuedci: auto-assign PR to its authorby M1nd3r · 6b63f387 · Mar 2, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · M1nd3r
ci: auto-assign PR to its author
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: security-sensitive path
AI review queuedtest(core/tron): add `yield` for cancellation input flowby Roman Zeyde · a26c0d3e · Feb 26, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Roman Zeyde
test(core/tron): add `yield` for cancellation input flow
[no changelog]
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit only changes a test file for the Tron cryptocurrency signing feature. It adds 'yield' statements to the test's simulated button-pressing sequence so the test properly waits between simulated user actions. There is no change to the actual Trezor firmware code that users run, and no security fix or vulnerability is present in the diff.
AI review queuedchore(translations): sync Crowdin translations [no changelog]by Michal Kazda · 8ff1930d · Feb 23, 2026 · 6 filesMessage 77 · AdequateTriage 0Details
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
AI review queuedfix(core): ignore unexpected messages in backup flowby Roman Zeyde · 46cee0ae · Feb 23, 2026 · 7 filesMessage 77 · AdequateTriage 7Details
Commit message · Roman Zeyde
fix(core): ignore unexpected messages in backup flow
I/O errors and timeouts are not handled.
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedfix: enforce Tron address padding in runtimeby obrusvit · d98c67b8 · Feb 20, 2026 · 1 fileMessage 57 · ThinModerate 61Details
Commit message · obrusvit
fix: enforce Tron address padding in runtime
[no changelog]
57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Moderate 61/100
This commit changes how Trezor handles Tron cryptocurrency smart-contract payments. Previously, the device used a programming assertion to assume that certain address-padding bytes were zero. Now it checks those bytes at runtime and rejects the transaction if the padding is wrong. The change likely prevents a malformed Tron token-transfer request from being misinterpreted or from causing the device to behave unexpectedly. It is a defensive hardening fix rather than a clear-cut remote exploit patch.
AI review queuedrefactor(core): extract `ButtonRequest` handler into a separate methodby Roman Zeyde · 05292d3b · Feb 20, 2026 · 6 filesMessage 77 · AdequateTriage 7Details
Commit message · Roman Zeyde
refactor(core): extract `ButtonRequest` handler into a separate method
Also, add a `Context.read()` overload for unexpected messages.
[no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedfix: testsby Ioan Bizău · e9f2c644 · Feb 20, 2026 · 2 filesMessage 12 · OpaqueTriage 0Details
Commit message · Ioan Bizău
fix: tests
[no changelog]
12/100 · OpaqueMessage clarity
✓ Uses a recognizable type or scope✓ Mentions testing or verification! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedfeat(tron): Unfreeze and claiming TRX - core logic - Refactored Unfreeze with freeze. - Simplified some definitions and label use. - Supports UnfreezeBalanceV2Contract and WithdrawExpireUnfreezeContractby PrisionMike · 86a4fc10 · Feb 20, 2026 · 7 filesMessage 85 · StrongLow 29Details
Commit message · PrisionMike
feat(tron): Unfreeze and claiming TRX - core logic - Refactored Unfreeze with freeze. - Simplified some definitions and label use. - Supports UnfreezeBalanceV2Contract and WithdrawExpireUnfreezeContract
[no changelog]
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 29/100
This commit adds support for two new TRON transaction types on Trezor hardware wallets: unfreezing staked TRX and withdrawing expired unfrozen balances. It also renames a field in the freeze/unfreeze messages from 'frozen_balance' to 'balance' and removes unused smart-contract function signatures. The changes are a routine feature addition for TRON staking operations and do not, on their own, look like a security fix or vulnerability.
AI review queuedfeat(tron): Unfreeze and claiming TRX - scaffoldingby PrisionMike · 0b399af5 · Feb 20, 2026 · 20 filesMessage 62 · AdequateInformational 15Details
Commit message · PrisionMike
feat(tron): Unfreeze and claiming TRX - scaffolding
- Generated code [no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine feature addition for the Trezor hardware wallet: it adds support for two new TRON blockchain operations (unstaking/unfreezing TRX and claiming unfrozen TRX). It updates protocol definitions, generated message bindings, translations, and test fixtures. There is no indication of a security vulnerability or fix in the changes themselves.
AI review queuedrefactor(core): use bitwise-AND for THP sync bit extractionby Roman Zeyde · 7b673111 · Feb 19, 2026 · 1 fileMessage 62 · AdequateTriage 7Details
Commit message · Roman Zeyde
refactor(core): use bitwise-AND for THP sync bit extraction
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedchore(l10n): new translations from crowdin [no changelog]by Michal Kazda · 915b743a · Feb 19, 2026 · 7 filesMessage 77 · AdequateInformational 15Details
Commit message · Michal Kazda
chore(l10n): new translations from crowdin [no changelog]
77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine update of translated user-interface text strings for the Trezor hardware wallet. It changes wording in Czech, German, Spanish, French, and Portuguese translation files, adds a couple of empty placeholder strings for an upcoming Ethereum feature, updates the translation signature file, and refreshes the expected UI test screenshot hashes. There is no code change that affects security, cryptography, or device behavior.
AI review queuedbuild(deps): bump urllib3 in /tools/automatic_battery_testerby dependabot[bot] · 0edb6df4 · Feb 18, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]
build(deps): bump urllib3 in /tools/automatic_battery_tester
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.5.0 to 2.6.3. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/2.5.0...2.6.3)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
- Main logic for Staking Tron for energy or bandwidth. - Scaffolding in preceding commit.
[no changelog]
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 32/100
This commit adds support for a new Tron blockchain operation called FreezeBalanceV2, which lets users stake TRX tokens to gain Energy or Bandwidth. The change is a feature addition: it adds the contract type to the list of supported transactions, shows the user a confirmation screen with the staking amount and resource type, and handles a protocol quirk where the default resource value must be omitted when serializing the transaction. There is no direct evidence in the commit of a security vulnerability, but any new signing path deserves careful review.
feat(tron): adding FreezeBalanceV2 message support
- Updated message definitions. Introduced new strings. - Mostly generated code. Main changes in subsequent commit.
[no changelog]
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit adds support for a new Tron blockchain operation called FreezeBalanceV2, which lets users stake TRX tokens to gain Energy or Bandwidth. The change only updates message definitions, generated code, test fixtures, and translation strings. There is no actual signing or user-interface logic in this commit, and nothing in the diff suggests a security vulnerability.
AI review queuedchore(core): add confirmation-related English string entriesby Roman Zeyde · 9b6995a5 · Feb 13, 2026 · 6 filesMessage 62 · AdequateInformational 15Details
Commit message · Roman Zeyde
chore(core): add confirmation-related English string entries
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit only adds two new English text labels, 'Confirm all' and 'Show next', to the Trezor firmware's translation system. It updates the generated code that maps internal keys to user-visible strings and refreshes the translation signature metadata. There is no change to security logic, user prompts, or how confirmations work.
AI review queuedrefactor(core): use non-async function ETH staking detectionby Roman Zeyde · 40c222e9 · Feb 12, 2026 · 1 fileMessage 62 · AdequateInformational 11Details
Commit message · Roman Zeyde
refactor(core): use non-async function ETH staking detection
[no changelog]
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 11/100
This commit is a small internal code cleanup in Trezor's Ethereum transaction signing code. It changes a function that detects and handles Ethereum staking transactions from an 'async' (pause-able) style to a regular function that returns a confirmation task. There is no visible change in behavior, no bug fix, and no security-relevant change described by the vendor.
AI review queuedchore: remove untranslated stringby Ioan Bizău · 40a37ffe · Feb 11, 2026 · 3 filesMessage 47 · ThinInformational 15Details
Commit message · Ioan Bizău
chore: remove untranslated string
[no changelog]
47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a minor user-interface cleanup. It removes a fallback English string ('Path ...') that was not part of the device's translation system and instead reuses an already-translated derivation-path label. It also stops the wallet from showing the same account information twice on screen when no proper account name is available. There is no security issue here.
AI review queuedfix: testsby Ioan Bizău · 78cb6b18 · Feb 11, 2026 · 1 fileMessage 12 · OpaqueTriage 0Details
Commit message · Ioan Bizău
fix: tests
[no changelog]
12/100 · OpaqueMessage clarity
✓ Uses a recognizable type or scope✓ Mentions testing or verification! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedchore(deps): bump protobuf from 6.32.0 to 6.33.5by dependabot[bot] · cad6d979 · Feb 10, 2026 · 1 fileMessage 88 · StrongTriage 0Details
Commit message · dependabot[bot]
chore(deps): bump protobuf from 6.32.0 to 6.33.5
Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 6.32.0 to 6.33.5. - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits)
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference