Every captured commit receives deterministic security triage and a separate communication-quality score. Full patches and Ollama analysis are reserved for ranked candidates.
5candidates5AI analyses
50commits · 30 days
69commits · 60 days
94commits · 180 days
176commits · 365 days
Backfill bands
Aug 5 → Feb 682 seen1 candidatesComplete
Feb 6 → Jun 625 seen2 candidatesComplete
Jun 6 → Jul 619 seen1 candidatesComplete
Jul 6 → Aug 548 seen1 candidatesComplete
Commit communication
Does the history explain itself?
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit adds a new feature to the secp256k1 cryptographic library: the sender-side logic for Bitcoin Silent Payments (BIP352). It lets a wallet create special one-time payment addresses for recipients without revealing which recipient …
New feature implementation for BIP352 Silent Payments sender sideExtensive input validation (ARG_CHECK) and test coverage for malformed keys and bad argumentsSensitive intermediate values (shared secrets, scalars) are explicitly cleared
This is a defensive code cleanup in a Bitcoin cryptography library. It introduces a helper function that wraps a common three-step pattern when multiplying by the generator point, ensuring that temporary sensitive Jacobian coordinate data …
New helper ensures intermediate Jacobian coordinates are always cleared after generator multiplicationCommit message states goal is to prevent accidental gej leaks of secret scalar informationRefactors existing call sites in ECDSA sign, Schnorr sign, pubkey creation, and blinding setup
This commit only fixes wording in the API documentation comments. It changes the description of a function output parameter from 'pointer to an array' to 'pointer to a signature object' in two header files. No actual code behavior changed,…
This commit fixes a bug in the ElligatorSwift-based ECDH key exchange function. The function was supposed to reject secret keys that are invalid (zero or greater than or equal to the curve order), but due to a one-character bug it only che…
Cryptographic secret-key validation bypassSilent modular reduction instead of rejection for out-of-range secretsInconsistency with documented/referenced ECDH overflow handling
This commit is a straightforward code cleanup: it removes unnecessary type casts in front of memory allocation calls like malloc. In modern C, casting the result of malloc is not needed and is generally discouraged. The change does not alt…
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Routine changeMerge bitcoin-core/secp256k1#1897: tests: check results before using outputsby merge-script · 687155df · Aug 4, 2026 · 8 filesMessage 96 · StrongTriage 0Details
Commit message · merge-script
Merge bitcoin-core/secp256k1#1897: tests: check results before using outputs
a2ad68cd81787ba70b2caff0a57998ae8a5b4834 ec: check pubkey sort test results (Lőrinc) 93280c22917c018f4e99d76e4398e66405c887bd silentpayments: check test serialization (Lőrinc) b8de1bc30f917c0ab9f05aeaeb494834e81513e2 musig: check infinity test setup (Lőrinc) 0618af81317307466e9968592880a54229885edc extrakeys: check test pubkey loads (Lőrinc) 1d3f72d3fa8e476cdc3344dbb5aebeaf7a6efe89 recovery: check exhaustive API results (Lőrinc) 564afb0b06e6124092fd6fa1239b1b397f742e41 ellswift: check test operation results (Lőrinc) 658c7edc24832592969ccbd1bdbc5c59e1ccc5d5 tests: check exhaustive ecmult success (Lőrinc)
Pull request description:
**Problem:** Several tests inspect outputs from deterministic operations without checking the result. The later output comparisons usually still exercise behavior, but a failed setup call can leave an output that accidentally satisfies a later assertion. In `pubnonce_summing_to_inf`, `secp256k1_musig_sum_pubnonces` initializes both sums to infinity before a pubnonce load can fail, so the test could pass without constructing a valid opposing-nonce pair.
**Fix:** Check the result of each deterministic operation before reading its output in the affected exhaustive, EllSwift, recovery, extrakeys, MuSig, silent-payments, and public-key sort tests. Leave deliberately ignored results alone when the test permits either result or validates a mutated value rather than an auxiliary carry, overflow, or sign flag.
ACKs for top commit: 151henry151: Tested ACK a2ad68cd81787ba70b2caff0a57998ae8a5b4834 real-or-random: utACK a2ad68cd81787ba70b2caff0a57998ae8a5b4834 theStack: ACK a2ad68cd81787ba70b2caff0a57998ae8a5b4834
sha256: cross-check caller supplied compression function
The existing selftest hashes one 63 byte string against a known digest. Which catches a compression function that is wrong everywhere, but not one that is wrong on multi-block calls, unaligned input, or a state that is not the IV.
This introduces secp256k1_sha256_smoke_test, which hashes messages of various lengths and starting offsets with both the supplied function and the built-in one, and fails if the digest differs.
The check runs once during startup, so a faulty compression function is caught early rather than silently producing incorrect output later.
Measured locally, this takes 1.5ms, which should be negligible for any application.
See the introduced test for a clear view of the bugs this catches.
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was security-ranked
cryptography-sensitive path
Routine changechangelog: add entry for #1821by Sebastian Falbesoner · 2076b06a · Aug 1, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Sebastian Falbesoner
changelog: add entry for #1821
Co-authored-by: Tim Ruffing <me@real-or-random.org>
73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was security-ranked
documentation-only discount
Routine changeellswift: don't declassify or leave sk in sha256 bufferby furszy · 0ae17e30 · Jul 30, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · furszy
ellswift: don't declassify or leave sk in sha256 buffer
secp256k1_ellswift_create assumes sha256 clears the data in its buffer after hashing it, which is not the case. So we shouldn't declassify the whole struct, only the hash result. We should also clear it at the end, so the sk doesn't linger on the stack when no aux rnd is given.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
✓ Descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was security-ranked
documentation-only discount
Routine changeheader: Add note on SHA256 override and aux functionsby Tim Ruffing · 4147f8bd · Jul 29, 2026 · 1 fileMessage 58 · ThinTriage 15Details
Commit message · Tim Ruffing
header: Add note on SHA256 override and aux functions
Resolves one item in #1835.
58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was security-ranked
cryptography-sensitive path
Routine changeecdsa/ecdh: Use SHA256 override if known noncefp/hashfp is passedby Tim Ruffing · ed091bc4 · Jul 29, 2026 · 2 filesMessage 50 · ThinTriage 15Details
Commit message · Tim Ruffing
ecdsa/ecdh: Use SHA256 override if known noncefp/hashfp is passed
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
This context pointer has been deprecated since the rename to `_context_static` more than three and a half years ago (see PR #1126, commit 53796d2b24e813750feae73e85c0a6eee40dc391), for the first official release 0.2.0. Removing it should be fine by now.
71/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Remove deprecated `secp256k1_schnorrsig_sign` alias
This function has been deprecated since the rename to `_schnorrsig_sign32` more than three and a half years ago (see PR #1089, commit 99e6568fc6), before the first official release 0.2.0. Removing it should be fine by now.
71/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was security-ranked
cryptography-sensitive path
Routine changechangelog: add missing entries for #1777 and #1860by Sebastian Falbesoner · f52eb393 · Jul 28, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Sebastian Falbesoner
changelog: add missing entries for #1777 and #1860
Adds changelog entries for merged PRs that still have the "needs-changelog" label, preparing for the upcoming release: - #1777: "Make SHA256 compression runtime pluggable" - #1860: "cmake: Emulate Libtool's behavior on NetBSD and OpenBSD"
Also adjusts the release notes for 0.7.0 regarding PR #1685 to be consistent.
81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The sender vector test compared serialized x-only public keys without requiring serialization to succeed. Check success before comparing the output bytes.
`pubnonce_summing_to_inf` initializes both sums to infinity before loading the nonce objects. A load failure could therefore satisfy the expected infinity checks without validating the constructed pair. Require both nonce-loading operations to succeed before testing their outputs.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
The exhaustive recovery tests decoded and verified signatures without requiring recoverable signing or conversion to succeed. Check those documented success results before consuming the outputs, matching the ordinary exhaustive signing test.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
The x-only parity test compared fields from two loaded points without requiring either load to succeed. Check both setup operations before reading their outputs.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
The EllSwift tests inspected outputs without requiring encoding, decoding, or public-key loading to succeed. They also discarded the field parser result despite relying on its no-overflow precondition. Check each deterministic success result before inspecting its output.
83/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
