fix(core): remove log from prod [no changelog]
What the developer wrote
Authored by M1nd3r
fix(core): remove log from prod
[no changelog]
What changed, and why it matters
This commit wraps a Bluetooth debug log message so it only appears in debug builds, not in production firmware. The change itself is minor and defensive: it prevents potentially sensitive Bluetooth connection details from being recorded in production logs. There is no direct evidence this created a practical security vulnerability, but logging internal state in production is generally considered poor security hygiene.
No urgent action required. Treat as a minor hardening improvement. If auditing, verify that other `log.debug`/`log.info` calls in production-facing homescreen or BLE code are similarly guarded or removed, and confirm production builds are compiled with `__debug__` disabled.
Security signals we found
Information disclosure reduction: Bluetooth connection flags and peer count no longer logged in production builds
Defense in depth: logging subsystem call removed from production code path
No functional code change; purely a logging hygiene fix
Evidence from the diff
The patch guards an existing log.debug() call in core/src/apps/homescreen/device_menu.py with if __debug__:. The logged string includes ble.connection_flags() and ble.peer_count(). In Python/MicroPython, __debug__ is false in optimized/production builds, so the log statement is now compiled out of production firmware. This reduces the production attack surface by avoiding emission of Bluetooth state information and by removing a call into the logging subsystem during homescreen interaction.
Changed components
core/src/apps/homescreen/device_menu.pyInspect captured patch +5 / −4
diff --git a/core/src/apps/homescreen/device_menu.py b/core/src/apps/homescreen/device_menu.py
index af871b8b4..9c9d5b6d4 100644
--- a/core/src/apps/homescreen/device_menu.py
+++ b/core/src/apps/homescreen/device_menu.py
@@ -44,10 +44,11 @@ async def handle_device_menu() -> None:
auto_lock_ms = storage.device.get_autolock_delay_ms()
auto_lock_delay = strings.format_autolock_duration(auto_lock_ms)
- log.debug(
- __name__,
- f"device menu, BLE state: {ble.connection_flags()} (peers: {ble.peer_count()})",
- )
+ if __debug__:
+ log.debug(
+ __name__,
+ f"device menu, BLE state: {ble.connection_flags()} (peers: {ble.peer_count()})",
+ )
menu_result = await interact(
trezorui_api.show_device_menu(
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.