CommitWatch RSS
FD
← All projectsFoundation

Passport firmware

Firmware for Foundation Passport Bitcoin signing devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

78 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Full patches and Ollama analysis are reserved for ranked candidates.

3candidates6AI analyses
3commits · 30 days
7commits · 60 days
66commits · 180 days
78commits · 365 days
Backfill bands
Aug 5 → Feb 612 seen0 candidatesComplete
Feb 6 → Jun 659 seen3 candidatesComplete
Jun 6 → Jul 64 seen0 candidatesComplete
Jul 6 → Aug 52 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

54/100 average clarity
2Strong · 80–100
28Adequate · 60–79
43Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Matt Gleason5314051
Jean-Pierre De Jesus DIAZ811061
Jack711063
dependabot[bot]500076
Ken Carpenter300048
Jacksper13100058
mjg-foundation100045
Analysis record

Published AI watches

Last scanned 24 minutes ago

Low 47 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: removed more branching from mnemonic decode process

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, reg…

Branchless, constant-time-style copy of sensitive input wordsMasking of post-delimiter bytes to zero to avoid information leakage via memory access patternsRemoval of conditional stores that depended on word length
d0edb18aby Matt Gleason+13−71 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: refined more comments

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

e58baa89by Matt Gleason+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: improved comments

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

42cad0d8by Matt Gleason+9−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 81 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

Pass expected_address through QR message signing path

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an ex…

Adds expected_address validation to a previously unvalidated code pathMirrors an existing security control from another input path (microSD / PR #636)Separates canonical/raw address used for verification from human-readable stylized address used for display
80fda3a1by Jack+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-4389: Update copyright e-mail address.

This commit is a bulk update of the company's contact email address in copyright headers and documentation. It replaces 'hello@foundationdevices.com' with 'hello@foundation.xyz' across 728 files. There are no code logic changes, no securit…

8c1f220bby Jean-Pierre De Jesus DIAZ+735−735728 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-3834: added microsd message signing

This commit adds a new menu option that lets users sign a message using a file stored on a microSD card, alongside the existing option to sign by scanning a QR code. It reuses the same internal signing logic that was already used for healt…

No new cryptographic operations introduced; existing sign_text_file_task is reusedNo changes to input validation length checks or address-type handlingFile filter now excludes files containing '-signed' to avoid re-signing output files
e47977e3by Matt Gleason+37−114 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Routine changeMerge pull request #651 from Foundation-Devices/firmware-update-validation-hardeningby Jacksper13 · 2e96f0af · Jul 30, 2026 · 1 fileMessage 58 · ThinTriage 0Details
Commit message · Jacksper13

Merge pull request #651 from Foundation-Devices/firmware-update-validation-hardening

Harden firmware update validation

58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was security-ranked
defensive validationboot or update pathmerge-commit duplicate discount
Routine changePreserve hardened firmware verification resultby Jack · a6efb276 · Jul 23, 2026 · 1 fileMessage 55 · ThinTriage 20Details
Commit message · Jack

Preserve hardened firmware verification result

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was security-ranked
defensive validationboot or update path
Routine changeHarden firmware update validationby Jack · b157473c · Jul 23, 2026 · 1 fileMessage 35 · OpaqueTriage 20Details
Commit message · Jack

Harden firmware update validation

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was security-ranked
defensive validationboot or update path
Routine changeSFT-7182: added coconut wallet to manifest, needs testing on hardwareby Matt Gleason · c84bf29d · Jun 23, 2026 · 1 fileMessage 60 · AdequateTriage 0Details
Commit message · Matt Gleason

SFT-7182: added coconut wallet to manifest, needs testing on hardware

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Routine changeAdd Coconut Wallet single-sig Connect Wallet optionby Jack · 9d60781d · Jun 17, 2026 · 4 filesMessage 73 · AdequateTriage 12Details
Commit message · Jack

Add Coconut Wallet single-sig Connect Wallet option

Add Coconut Wallet (noncelab) to the Connect Wallet flow. It reuses the
generic single-sig JSON export (same payload as Sparrow) over an animated
UR2 QR code: single-sig QR only, no multisig or microSD.

Tag the export with a "model" field set to "passport-core" so Coconut
Wallet can label the imported wallet "Passport Core" (it shows a single
"Passport" connector and names the wallet from this flag). The field is
gated on the wallet config carrying a 'model' key, so all other wallets'
exports are unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was security-ranked
signing or wallet path
Routine changeSFT-7133: fixed dangerous change check on all taproot inputsby Matt Gleason · 46efe834 · Jun 11, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-7133: fixed dangerous change check on all taproot inputs

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changeSFT-6378: removed more branching from mnemonic decode processby Matt Gleason · d0edb18a · Jun 11, 2026 · 1 fileMessage 50 · ThinLow 47Details
Commit message · Matt Gleason

SFT-6378: removed more branching from mnemonic decode process

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
cryptography-sensitive pathboot or update path
AI analysis · Low 47/100

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, regardless of how long each word is. The stated goal is to make the copy operation take the same amount of time and perform the same memory accesses for every word length, which can help defend against timing and power-analysis side-channel attacks that might otherwise leak information about the recovery phrase.

Routine changeSFT-6378: refined more commentsby Matt Gleason · e58baa89 · May 29, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Matt Gleason

SFT-6378: refined more comments

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

Routine changeSFT-6378: improved commentsby Matt Gleason · 42cad0d8 · May 28, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Matt Gleason

SFT-6378: improved comments

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was security-ranked
cryptography-sensitive pathboot or update path
AI analysis · Informational 15/100

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

Routine changeSFT-6378: responded to more feedback, needs testing and evaluationby Matt Gleason · 42f95ed8 · May 25, 2026 · 1 fileMessage 60 · AdequateTriage 27Details
Commit message · Matt Gleason

SFT-6378: responded to more feedback, needs testing and evaluation

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was security-ranked
cryptography-sensitive pathboot or update path
Routine changeSFT-6378: made more parts of mnemonic parsing and fetching constant timeby Matt Gleason · 5a0cc5ed · May 24, 2026 · 3 filesMessage 50 · ThinTriage 27Details
Commit message · Matt Gleason

SFT-6378: made more parts of mnemonic parsing and fetching constant time

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
cryptography-sensitive pathboot or update path
Routine changeSFT-6378: first pass at anti-sidechannel round 2, needs testing and evaluationby Matt Gleason · 2c7dc29f · May 19, 2026 · 4 filesMessage 75 · AdequateTriage 27Details
Commit message · Matt Gleason

SFT-6378: first pass at anti-sidechannel round 2, needs testing and
evaluation

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was security-ranked
cryptography-sensitive pathboot or update path
Routine changeLift bounded_message_read to module levelby Jack · e6e05ffb · May 14, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Jack

Lift bounded_message_read to module level

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Routine changeBound microSD message read at read time, not via separate statby Jack · c8f53cf8 · May 13, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Jack

Bound microSD message read at read time, not via separate stat

A separate stat in its own CardSlot() left a TOCTOU window where a swapped file could still be read unbounded. Move the cap into a bounded read_fn inside the read.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Routine changeSFT-6948: fixed add-secrets portability, removed unnecessary error wallingby Matt Gleason · 7a55a01e · May 12, 2026 · 2 filesMessage 65 · AdequateTriage 0Details
Commit message · Matt Gleason

SFT-6948: fixed add-secrets portability, removed unnecessary error
walling

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Routine changeEnforce MSG_SIGNING_MAX_LENGTH on microSD message signingby Jack · a6dfc59f · May 11, 2026 · 1 fileMessage 81 · StrongTriage 18Details
Commit message · Jack

Enforce MSG_SIGNING_MAX_LENGTH on microSD message signing

Restores the file-size cap that the deleted SignTextFileFlow used to
provide before its consolidation in #636. Gated on normal_signing so
health-check files (with their own implicit length constraints) are
unaffected.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was security-ranked
signing boundary
Security candidatePass expected_address through QR message signing pathby Jack · 80fda3a1 · May 11, 2026 · 1 fileMessage 81 · StrongModerate 59Details
Commit message · Jack

Pass expected_address through QR message signing path

Mirrors the WYSIWYG-signing assertion that microSD signing already has
(added in #636). Keeps self.address raw (used as expected_address) and
uses a local display_address for stylization in the preview.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was security-ranked
signing boundarysigning or wallet path
AI analysis · Moderate 59/100

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an explicit 'expected address' check. The microSD signing path already had this safety check. After the change, the raw, verified address is passed through and used to confirm the signature is for the correct address, while a stylized version is still shown on screen. This reduces the risk that a tricked or confused user signs a message with the wrong address.

Routine changeSFT-3834: fixed return type for quitting message signingby Matt Gleason · 3f29f056 · May 11, 2026 · 1 fileMessage 50 · ThinTriage 18Details
Commit message · Matt Gleason

SFT-3834: fixed return type for quitting message signing

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing boundary
Routine changeSFT-3834: formatted code, added autopep8 to nix devshellby Matt Gleason · e77f08d3 · May 9, 2026 · 3 filesMessage 50 · ThinTriage 0Details
Commit message · Matt Gleason

SFT-3834: formatted code, added autopep8 to nix devshell

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Routine changeSFT-3834: ensured preview address matches the signed output addressby Matt Gleason · 434d4bcc · May 9, 2026 · 3 filesMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-3834: ensured preview address matches the signed output address

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changeSFT-3834: removed unused security_menu and sign_text_file_flowby Matt Gleason · d7a7b23d · May 8, 2026 · 4 filesMessage 50 · ThinTriage 12Details
Commit message · Matt Gleason

SFT-3834: removed unused security_menu and sign_text_file_flow

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changeSFT-6948: removed unnecessary add-secrets build inputs and inherited itemsby Matt Gleason · 9c1e3654 · May 8, 2026 · 2 filesMessage 65 · AdequateTriage 0Details
Commit message · Matt Gleason

SFT-6948: removed unnecessary add-secrets build inputs and inherited
items

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Routine changeSFT-6948: added "add-secrets" to devshellby Matt Gleason · f4f7b4ca · May 6, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · Matt Gleason

SFT-6948: added "add-secrets" to devshell

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Routine changeSFT-3834: fixed lintby Matt Gleason · 54098dfd · May 6, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Matt Gleason

SFT-3834: fixed lint

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Routine changeSFT-3834: added verify step for microsd message signing, fixed export format for sparrow parsingby Matt Gleason · 18e80883 · May 6, 2026 · 2 filesMessage 75 · AdequateTriage 18Details
Commit message · Matt Gleason

SFT-3834: added verify step for microsd message signing, fixed export
format for sparrow parsing

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was security-ranked
signing boundary