CommitWatch RSS
SP
← Watched projectsVendor accountability

Specter

Vendor website ↗
Security hygiene0/100 · Insufficient dataPreliminary score
How the vendor scores

Security hygiene breakdown

Disclosure quality 0/100
Researcher acknowledgement 0/100
Security process 0/100
Patch clarity 0/100
Response quality 0/100
Accountability record

Recent watches

Informational 15 AI analysisMessage 68 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

Fix reproducible build (#371) (#412)

This commit fixes the firmware build process so that two people building from the same source code get the exact same binary file. Previously, the build script embedded local git details (like the repository URL, branch name, or commit has…

Reproducible build hardeningRemoval of build-environment-dependent metadata from release artifactsHash-locked dependency installation via pip --require-hashes
e4266c10by Schnuartz AI+218−196 files
No security note in commit
Open full analysis →Source commit ↗
High 77 AI analysisMessage 93 · Strong
SP SpecterSpecter DIY BitcoinHardware wallets

Fix: Reject dead-TRNG output in get_random_bytes (#370) (#372)

This commit fixes a security bug in how Specter DIY generates random numbers for creating cryptocurrency wallet secrets. Previously, if the hardware random-number generator (TRNG) stalled or failed, the device would silently use all-zero o…

Silent use of dead TRNG output for cryptographic seed generationTRNG timeout returns 0 per byte, producing all-zero or majority-zero buffersEntropy pool was fed with dead bytes before any validation
65fcb983by White7hat7+221−73 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 78 AI analysisMessage 85 · Strong
SP SpecterSpecter DIY BitcoinHardware wallets

feat: Fix change-output classification to require verified descriptor derivation (#387)

This commit fixes a security bug in Specter DIY, a hardware wallet, where the device could wrongly hide a transaction output as 'change' (your own money coming back) when it actually went to an attacker or to another of your own wallet add…

Fixes incorrect change-output classification that could hide attacker-controlled or self-payment outputsAdds cryptographic verification of PSBT derivation metadata against locally stored descriptor and output scriptPubKeyAdds explicit warnings for inconsistent host-supplied change metadata
fc0e32d6by Schnuartz AI+1514−599 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 65 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

chore: Update embit to v0.8.2 (#376)

This commit updates the embedded embit cryptography library to version 0.8.2 and adds a small compatibility shim so Specter DIY can accept a new style of Bitcoin wallet descriptor that mixes fixed and multi-path keys. Most of the changes a…

Dependency update to embit v0.8.2Monkey-patch of cryptographic descriptor parsing to bypass a library validation errorNew test coverage for mixed multipath/fixed-path descriptor parsing
2ff670caby Mike Tolkachev+224−1116 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 73 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

Re-add mixed-inputs warning for multi-wallet transactions (#382)

This commit restores a security warning on the Specter DIY hardware wallet. When a user is about to sign a Bitcoin transaction that spends coins from more than one wallet, or from several unknown sources, the device now shows a clear 'mixe…

Re-adds a security warning that was previously removedMitigates multisig/mixed-input change-address attack classWarning is now displayed at the top of the confirmation screen without requiring scrolling
72234589by Schnuartz AI+283−218 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

Bump firmware version to v1.10.3 (#351)

This commit changes a single version number string in the bootloader from v1.10.1 to v1.10.3. There is no functional code change, no bug fix, and no security-relevant behavior modification. It is purely a release version bump.

eb8397d2by k9ert+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 68 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

Update bootloader submodule to latest (#350)

This commit only updates a Git submodule pointer for the bootloader to a newer commit. No actual source code changes are shown, and no verified security references were provided. There is no direct evidence in the materials that this updat…

95353b64by k9ert+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 53 · Thin
SP SpecterSpecter DIY BitcoinHardware wallets

Bump firmware version to v1.10.1 (#346)

This commit simply updates a hardcoded firmware version string from v1.10.0 to v1.10.1 and removes a trailing space in a comment. There is no functional code change and no security relevance visible in the diff.

df07bb65by Mike Tolkachev+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
SP SpecterSpecter DIY BitcoinHardware wallets

Fix: minor comment cleanups (#343)

This commit only fixes three comments in the source code: two replace the word 'he' with 'they' for inclusive language, and one corrects 'dont' to 'don't'. No executable code, logic, or security behavior was changed.

8131bc93by al-munazzim+3−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
SP SpecterSpecter DIY BitcoinHardware wallets

Docs: fix grammar and update LVGL library name (#342)

This commit only updates two lines in documentation files: it renames the GUI library from 'LittlevGL' to 'LVGL' and fixes a grammar typo ('splitted' to 'split'). There are no code changes and no security implications.

d6c2bb0eby al-munazzim+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
SP SpecterSpecter DIY BitcoinHardware wallets

release: prepare release (#340)

This commit is a routine release preparation for the Specter DIY hardware wallet. The only meaningful change is updating an embedded version string from '0100900099' to '0101000099'. There are no security fixes, new features, or behavior c…

30ebb834by k9ert+62−622 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 58 · Thin
SP SpecterSpecter DIY BitcoinHardware wallets

Fix #329: Hide disabled QR scanner in recovery phrase import menu (#338)

This commit fixes a UI bug in the recovery phrase import menu. Previously, the menu showed buttons for import methods (like a QR scanner) even when those methods were disabled. Now it only shows methods that are actually enabled. This is a…

UI consistency fix for disabled functionalityNo cryptographic, authentication, or authorization changesNo input validation, memory safety, or privilege changes
6bbec30aby Azzbo77+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

feat: Removed ben and added k9ert keys for releasing (#306)

This commit updates the list of trusted public keys used to sign firmware releases for the Specter DIY hardware wallet. One maintainer's key (ben) was removed and another maintainer's key (k9ert) was added. There is no code change that int…

7bfd5196by k9ert+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 73 · Adequate
SP SpecterSpecter DIY BitcoinHardware wallets

Show Transaction Version, Locktime and inputs' sequences when signing transactions! (#321)

This commit adds more information to the transaction signing screen of the Specter DIY hardware wallet. It now shows the transaction version, locktime, and each input's sequence number, helping users spot unusual transaction settings (such…

UI now surfaces transaction version, nLockTime, and input nSequence during signingSequence values are interpreted to warn about RBF and relative locktimeLocktime is flagged when all inputs have sequence=0xFFFFFFFF (locktime disabled)
3d1bb8edby Oren+207−108 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 93 · Strong
SP SpecterSpecter DIY BitcoinHardware wallets

Add full M3Y support and fix QR scanning issues for GM65 and M3Y (#335)

This commit adds support for a new QR scanner model (M3Y) and fixes several QR scanning bugs for existing GM65 scanners. The changes are primarily about hardware compatibility and reliability: making sure different scanner models are detec…

No memory-safety fixes (buffer increase is functional, not overflow mitigation)No input validation or sanitization changes beyond completeness checks for QR framesNo cryptographic changes
97ab4d41by Tads+361−1222 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
SP SpecterSpecter DIY BitcoinHardware wallets

Add support for selecting and combining build actions (#333)

This commit is a build-system and documentation refactor. It splits a single long firmware build script into smaller selectable actions (like 'build main firmware', 'build bootloader', 'assemble', 'sign', 'hash', etc.), fixes a Dockerfile …

1f98790bby Tads+194−605 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 53 · Thin
SP SpecterSpecter DIY BitcoinHardware wallets

Add bootloader to upgrade binary (#323)

This commit changes a build script so that the upgrade package now includes the bootloader alongside the main application firmware, and adds a safety flag that stops the script on first error. There is no direct evidence in the commit that…

Build script now includes bootloader in upgrade binaryBuild script now fails fast with set -eNo explicit security claim in commit message or diff
ed9ad9a6by k9ert+4−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
SP SpecterSpecter DIY BitcoinHardware wallets

fix: import issues (#332)

This commit fixes how the project's test scripts set up Python's module search path and how they detect a missing optional dependency. It only changes files inside the 'test/' directory, which are used for running automated tests on a regu…

5bc685c5by k9ert+16−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 58 · Thin
SP SpecterSpecter DIY BitcoinHardware wallets

Fix for newer GM65 Scanners scanning CompactSeedQR + Add "About Screen" (#299)

This commit is primarily a hardware-compatibility fix for newer GM65 QR scanners used with the Specter DIY Bitcoin hardware wallet. It adds logic to detect a specific scanner firmware version and enable a special 'RAW' mode so binary QR co…

Adds STM32 flash read/write protection status reporting (RDP level, write protection)Adds firmware boot mode detection via VTOR addressAdds bootloader lock status reporting
031d285bby 3rd Iteration+596−489 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
SP SpecterSpecter DIY BitcoinHardware wallets

Update build firmware.sh to add no bootloader build by default (#315)

This change simply updates the project's firmware build script and documentation to also produce a 'no bootloader' firmware image by default. It is a developer convenience for testing on development boards and does not alter any runtime co…

6f66962aby 3rd Iteration+21−03 files
No security note in commit
Open full analysis →Source commit ↗