What the developer wrote
Authored by Peter D. Gray
few notes
What changed, and why it matters
This commit only changes documentation files. It adds a menu item to a text file, creates a new help document about spending policies, and makes a minor wording tweak to a web 2FA description. There are no code changes, no bug fixes, and no security-relevant modifications to the firmware itself.
No security action required. Review as normal documentation update if desired.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit touches three documentation files: docs/menu-tree.txt adds ‘Key Teleport (start)’ to the menu tree; docs/spending-policy.md is a new markdown file describing a spending policy feature and recommending ‘Lock Down Seed’ when using BIP-39 passphrases; docs/web2fa.md changes one line from ‘prepend 33 bytes of pubkey, and base64url encode all of it’ to ‘prepend 33 bytes of pubkey, and then base64url encode all of it’. No source code, build scripts, tests, or cryptographic implementations are modified.
Changed components
docs/menu-tree.txtdocs/spending-policy.mddocs/web2fa.mdInspect captured patch +20 / −1
diff --git a/docs/menu-tree.txt b/docs/menu-tree.txt
index 0f40e85..0bb460d 100644
--- a/docs/menu-tree.txt
+++ b/docs/menu-tree.txt
@@ -30,6 +30,7 @@
Tapsigner Backup
Seed XOR
Migrate Coldcard
+ Key Teleport (start)
Help
Advanced/Tools
View Identity
diff --git a/docs/spending-policy.md b/docs/spending-policy.md
new file mode 100644
index 0000000..3b398a5
--- /dev/null
+++ b/docs/spending-policy.md
@@ -0,0 +1,18 @@
+
+# Spending Policy
+
+A special mode where your coldcard will stop you from signing transactions if
+they exceed a spending policy you define beforehand.
+
+
+
+## Tips and Tricks
+
+If you are using a BIP-39 passphrase for everything, you should
+probably do a "Lock Down Seed" (Advanced/Tools > Danger Zone > Seed
+Functions) first. This takes your master seed and bip-39 passphrase
+and cooks them together into an XPRV which then is stored as your
+master secret (not a seed phrase anymore). This process cannot be
+reversed, so other funds you may have on the same seed words are
+protected. Once you are operating in XPRV mode, you can define a
+spending policy and know that it is restricted to only that wallet.
diff --git a/docs/web2fa.md b/docs/web2fa.md
index c465562..4f0e04e 100644
--- a/docs/web2fa.md
+++ b/docs/web2fa.md
@@ -62,7 +62,7 @@ but we may find other uses for it.
- multiplies that private key by server's known public key
- apply sha256(resulting coordinate) => the session key
- apply AES-256-CTR over URL contents (ascii text)
-- prepend 33 bytes of pubkey, and base64url encode all of it
+- prepend 33 bytes of pubkey, and then base64url encode all of it
- full url is: `https://coldcard.com/2fa?{base64 encoded binary}`
## Trust Issues
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.