What the developer wrote
Authored by Peter D. Gray
test we show BIP-39 passphrase
What changed, and why it matters
This commit only adds a single line to a test file. It checks that when a user adds a BIP-39 passphrase to create a temporary seed, the COLDCARD device displays the passphrase back to the user on screen. This is a test-only change and does not modify the firmware itself. It is not a security fix or vulnerability.
No action required. This is a benign test-only commit. If reviewing related functionality, confirm the passphrase display occurs only with appropriate user consent and does not leak to logs or untrusted outputs.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds an assertion in testing/test_bip39pw.py: assert passphrase in story. This verifies that the UI story shown after creating an ephemeral/temporary seed from a BIP-39 passphrase contains the passphrase string. No firmware code is changed. The commit is purely increasing test coverage for an existing UI behavior.
Changed components
testing/test_bip39pw.pyInspect captured patch +1 / −0
diff --git a/testing/test_bip39pw.py b/testing/test_bip39pw.py
index 4dde91a..95b3329 100644
--- a/testing/test_bip39pw.py
+++ b/testing/test_bip39pw.py
@@ -367,6 +367,7 @@ def test_bip39pass_on_ephemeral_seed(generate_ephemeral_words, import_ephemeral_
assert "created by adding passphrase to" in story
assert tmp_fp == title_xfp
assert f"current active temporary seed [{parent_fp}]" in story
+ assert passphrase in story
press_select()
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.