CommitWatch RSS
PD
← Developer activityStrong match

Peter D. Gray

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

146 commits1 monitored projects20 candidates2 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to Peter D. GrayA visual map of monitored and externally discovered repositories.PDdeveloper146COLDCARD firmware
Monitored evidence

CommitWatch projects

COLDCARD firmwareCoinkite146 commits20 candidates2 high risk
External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Critical 91 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

fixes rng

This commit fixes a critical random-number bug in COLDCARD hardware wallets. The device was accidentally using a weak, software-based fallback random generator instead of its secure hardware one when creating Bitcoin seed phrases. Because …

Weak/fallback PRNG silently linked in place of hardware RNGSeed phrase entropy reduction allowing private-key recoveryBuild-system override of upstream rng.o with empty object
ca724637by Peter D. Gray+60−711 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 18 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

new bootloader

This commit adds a new pre-built bootloader release (version 3.3.0) for the COLDCARD Mk4 hardware wallet. It consists of binary firmware files and a hash manifest, plus a disassembly listing. There is no source code change, no vulnerabilit…

02b5a756by Peter D. Gray+34698−05 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Mk hardware

This commit adds support for a new COLDCARD hardware revision, the Mk5. It is a routine product-enablement patch: it teaches the firmware, bootloader, build system, simulator, and signing tools to recognize and run on Mk5 devices. There is…

No security-relevant signals detected in the diff.Change is hardware bring-up / product enablement only.No fixes for memory corruption, authentication bypass, cryptographic flaws, or privilege escalation.
38553d1aby Peter D. Gray+728−27643 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 55 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

test we show BIP-39 passphrase

This commit only adds a single line to a test file. It checks that when a user adds a BIP-39 passphrase to create a temporary seed, the COLDCARD device displays the passphrase back to the user on screen. This is a test-only change and does…

06879c59by Peter D. Gray+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

show BIP-39 passphrase on-screen

This change makes the COLDCARD hardware wallet display the user's BIP-39 passphrase on the device's own screen after it is applied. This is a deliberate UX change, not a hidden bug. It could slightly increase the risk that someone physical…

Sensitive user secret (BIP-39 passphrase) rendered in on-screen UI messageNo input validation, encryption, or access-control changesNo remote or USB-exposed behavior changed
21392bd3by Peter D. Gray+14−61 file
No security note in commit
Open full analysis →Source commit ↗
High 80 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

deltamode timing fix

This commit fixes a bug in COLDCARD's 'deltamode' duress feature. Delta mode is meant to let a thief who knows a slightly wrong PIN sign transactions with corrupted signatures that look valid but don't actually protect any bitcoin. The bug…

duress/deltamode bypasspredictable signing digest replaced with transaction-dependent digestprivate-key recovery claimed by independent researchers
fcd848d8by Peter D. Gray+9−91 file
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →