AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 37 Bitcoin

fix(core): make app_name required for THP pairing

Public commit record

What the developer wrote

Authored by Martin Milata

57/100 · Thin
fix(core): make app_name required for THP pairing

[no changelog]
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
The short version

What changed, and why it matters

This commit tightens the rules for a Trezor pairing request by making both the host name and app name mandatory. Previously, the app name was optional, which could have led to a confusing or misleading pairing screen on the device. The change helps ensure users see complete, accurate information before approving a connection.

Recommended action

Treat as a minor hardening improvement. Review whether any existing clients or integrations still send ThpPairingRequest without app_name, because they will now fail. No urgent security response is indicated by the diff alone.

Security signals we found

01

Input validation strengthened: missing host_name and app_name now both raise DataError

02

Protobuf schema changed from optional to required for ThpPairingRequest fields

03

UI pairing dialog now guaranteed to receive both host and app identifiers

04

No changelog entry present ([no changelog])

Risk score

Why this scored 37/100

Our methodology →
Potential impact 8/30
Exploitability 7/25
Stealth signal 6/15
Affected reach 5/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.