CommitWatch RSS
SW
← All projectsSparrow

Sparrow Wallet

Desktop Bitcoin wallet focused on security, privacy, multisignature, and hardware signers.

BitcoinHardware integrationSoftware walletsNormal
Source repository ↗
Repository coverage

281 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Full patches and Ollama analysis are reserved for ranked candidates.

33candidates33AI analyses
46commits · 30 days
53commits · 60 days
181commits · 180 days
281commits · 365 days
Backfill bands
Aug 5 → Feb 6100 seen9 candidatesComplete
Feb 6 → Jun 6128 seen15 candidatesComplete
Jun 6 → Jul 67 seen1 candidatesComplete
Jul 6 → Aug 546 seen8 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

46/100 average clarity
0Strong · 80–100
20Adequate · 60–79
212Thin · 40–59
49Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Craig Raw2683232046
nroktib111050
doblon8300048
Liz Lightning200045
Michele Balistreri200048
craigraw100060
Ian McKenzie100050
nzb-tuxxx100060
PeterXMR100045
ottosch100050
Analysis record

Published AI watches

Last scanned 25 minutes ago

Low 42 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

reject extended private keys when creating a terminal watch only wallet, and show import errors

This commit fixes a bug in Sparrow Wallet's terminal (command-line) watch-only wallet creation. Previously, a user could accidentally paste an extended private key (xprv) into a dialog meant only for public keys or output descriptors, and …

Prevents accidental import of extended private keys into watch-only wallet contextSurfaces previously swallowed import errors to the user via error dialogChanges exception handling from ImportException-only to all exceptions
fa0d4841by Craig Raw+19−152 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add bitbox02 attestation failed dialog

This commit adds a user-facing warning dialog when a BitBox02 hardware wallet fails an attestation check. Attestation is a process that helps verify the device is genuine and not a counterfeit or tampered unit. Previously, a failed attesta…

Adds explicit user warning for failed hardware wallet attestationPrevents repeated warning dialogs during device enumeration using AtomicBooleanWarns user not to store funds on potentially counterfeit device
1a810c06by Craig Raw+16−12 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

improve validation of payjoin proposals, and accept a substituted payment output where a change output is present

This commit strengthens how Sparrow Wallet checks Payjoin proposals received from a payment receiver. Payjoin lets a receiver add their own inputs to a transaction to improve privacy. The changes add missing checks that could previously le…

Added minimum fee-rate enforcement on Payjoin proposalsAdded Taproot (P2TR) key-path and derived-public-key validation and propagationRestricted payment-output substitution to proposals that retain a change output
32f7e58fby Craig Raw+250−233 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

remove unused signature verification results in satochip and keycard signers, note where signatures are verified

This commit removes leftover code that checked whether signatures from hardware card signers were valid, but then threw away the result. The signatures are still verified later by a different part of the wallet when the signed transaction …

Removal of local signature verification calls in hardware signer code pathsAdded comments documenting that signature verification occurs later via PSBT.verifyCombinedSignatures()Unused boolean results indicate the removed checks were dead code rather than active security controls
866e9893by Craig Raw+5−132 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add option to ignore dust on private key sweep

This commit adds a user-facing checkbox labeled 'Ignore dust' to the private-key sweep feature in Sparrow Wallet. When enabled, very small ('dust') unspent outputs linked to the swept key are excluded from the transaction. This is a usabil…

Adds user-controlled filtering of UTXOs by value thresholdUses existing 'dustAttackThreshold' configuration, implying prior anti-dust handling elsewhereNo input validation, cryptographic, or authorization changes
cf797ea0by nroktib+21−21 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 55 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

update external tor socks proxy control port authentication

This commit hardens how Sparrow Wallet talks to an external Tor proxy's control port. Previously, when asking Tor for a new identity, the app used an older authentication method that could send the contents of a secret cookie file over the…

Switches Tor ControlPort authentication from legacy COOKIE to SAFECOOKIE HMAC challenge-responseAdds loopback-only restriction for external Tor ControlPort connectionsValidates cookie file length and uses constant-time hash comparison
b3d51bceby Craig Raw+83−81 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

check all open tabs when verifying a scanned or loaded transaction matches the originating psbt

This commit tightens how Sparrow Wallet checks that a scanned QR code or loaded file matches the transaction the user is currently working on. Previously, the app only compared the new transaction/PSBT against the single currently open tab…

UI workflow hardening: cross-tab verification prevents acceptance of mismatched transactions/PSBTsPreviously, verification was scoped to a single tab's context PSBT, which could be bypassed by tab confusion or user errorSilent Payments edge case preserved: possibleUnverifiableSilentPaymentsTransaction still triggers a dedicated warning
078af174by Craig Raw+66−234 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 60 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

verify scanned or loaded transactions match the originating psbt

This commit adds a safety check in the Sparrow Wallet desktop app to make sure a transaction loaded from a file or scanned from a QR code actually matches the PSBT (a partially-signed Bitcoin transaction) that was already open. Before this…

New integrity/matching validation between an originating PSBT and subsequently loaded or scanned transactions/PSBTsUser-facing error dialogs for mismatched transactions and silent-payment transactionsPrevention of displaying a substituted transaction as if it were the intended one
4b8a4594by Craig Raw+64−284 files
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 62 · Adequate
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

change bip329 wallet labels export to only assert spendable false for frozen coins and omit otherwise

This commit fixes how Sparrow Wallet exports coin labels in the BIP-329 format. Previously, the export incorrectly marked every unspent coin as 'spendable=true' in the exported file, even though the BIP-329 specification says the 'spendabl…

Incorrect BIP-329 field semantics in wallet label exportPotential for importing wallets to misclassify frozen coins as spendablePrivacy/information disclosure from asserting spendable=true on all unspent UTXOs
37bab9f3by Craig Raw+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 55 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

improve verification of psbt sighash types

This commit adds a safety check in Sparrow Wallet when opening a PSBT (a file format used to pass partially-signed Bitcoin transactions between wallets). Before this change, the wallet did not verify the signature-hash types declared insid…

New user-facing warning for 'Unsafe PSBT'Adds signature-hash verification on PSBT loadCatches PSBTSignatureException specifically
61ed816cby Craig Raw+11−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add custom context menu to signature text area in message sign dialog

This commit adds a standard right-click menu (copy, paste, clear) to the signature text box in Sparrow Wallet's message signing dialog. It is a routine user-interface convenience improvement with no security relevance visible in the code o…

287c943bby Craig Raw+11−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

improve loaded psbt verification

This commit changes how Sparrow Wallet checks the silent payment addresses inside a loaded PSBT (a partially signed Bitcoin transaction). Previously, the wallet extracted and trusted the silent payment addresses directly from the PSBT file…

Moved silent payment address extraction from controller to wallet-side verification methodRemoved direct trust of PSBT-supplied silent payment address and address-script mappingCommit title explicitly describes the change as improving verification
cb92f765by Craig Raw+3−142 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

update bip322 implementation to match completed spec

This commit adds a safety check when extracting a BIP-322 signature from a signed PSBT file. Before, Sparrow would blindly copy the signature into the dialog even if the message inside the PSBT did not match the message the user originally…

Added message-mismatch warning before extracting BIP-322 signature from PSBTPrevents silent overwrite of signature field when PSBT message differs from dialog messageNull-check guards added at both PSBT signature extraction call sites
bc7a0be8by Craig Raw+19−52 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add bip322 message signing for silent payments wallets

This commit adds the ability for Sparrow Wallet users with 'silent payments' wallets to sign messages using the BIP322 standard. It is a feature addition that extends existing message-signing support to a new wallet type. There is no indic…

No security-relevant signals detected in the diffFeature addition: BIP322 message signing for silent payments walletsPrivate key material is cleared from memory after signing (spendPrivKey.clear(), privKey.clear())
a2eb937fby Craig Raw+47−244 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add policy type to all keystore import interfaces and factory methods for explicit keystore xpub or spscan field population

This commit is a broad code change that threads a new 'policy type' value through many wallet import paths. The main practical effect visible in the diff is adding support for importing a new kind of Bitcoin wallet called 'silent payments'…

Adds silent payments (BIP352) scan key import path for Coldcard singlesigRemoves hard-coded WalletModel assignments in several importer subclasses, relying on getWalletModel()Changes SettingsController script-type selection behavior to always pick the default for the selected policy type
0459f4caby Craig Raw+200−10857 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

improve sp related output descriptor and psbt behaviour

This commit improves how Sparrow Wallet handles a newer Bitcoin address type called 'Silent Payments' (SP). It adds null-safety checks so the app doesn't crash when an extended public key is missing, supports exporting and importing labels…

Null-pointer dereference prevention added in BaseController, WalletLabels, KeystoreController, and SettingsControllerNew Silent Payments descriptor export format with additional argumentsNew 'spscan' label type in WalletLabels import/export
c23dbeedby Craig Raw+46−149 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

implement silent payments change outputs and other sp related fixes

This commit adds support for silent payment change outputs in the Sparrow Wallet and fixes related silent payment issues. Silent payments are a newer Bitcoin privacy feature that lets someone receive payments without publicly revealing the…

New feature: silent payments change output supportDefensive check: blocks Bitcoin Core scanning for SINGLE_SP silent payment walletsAddress derivation change: getFreshNode replaced with getNode in several places
c6700884by Craig Raw+69−158 files
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

initial policy type related changes from drongo

This commit is a large but mechanical rename in the Sparrow Wallet codebase. It replaces the old policy type constants `PolicyType.SINGLE` and `PolicyType.MULTI` with more specific names `PolicyType.SINGLE_HD` and `PolicyType.MULTI_HD`, an…

Large enum rename across wallet import/export, signing, and address derivation pathsNew policy type `SINGLE_SILENT_PAYMENTS` introduced with limited exporter supportMessage signing now explicitly restricted to HD single-sig wallets
8780e515by Craig Raw+96−8831 files
No security note in commit
Open full analysis →Source commit ↗
Low 39 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

add bip32 derivation fallback when retreiving signing nodes for high-index inputs

This commit adds a fallback path for finding the correct private signing keys when a Bitcoin wallet handles unusual transaction inputs that use very high address indexes. Without the fallback, Sparrow might fail to locate the right key and…

Touches private-key derivation / signing-node lookupRelates to high-index BIP32 derivation pathsOne-line change in wallet signing logic
32a35ed2by Craig Raw+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 55 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

avoid npe when the extracting signature from a bip322 psbt

This commit fixes a null pointer exception (a common software crash) that could occur when Sparrow Wallet tried to extract a signature from a special type of Bitcoin proof-of-ownership transaction (BIP322 PSBT). Without seeing the actual c…

NullPointerException in signature extraction pathBIP322 PSBT handling code touchedOne-line defensive fix
21f9f9feby Craig Raw+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Routine changeavoid deleting the backups of same-prefixed walletsby Craig Raw · b6ed4ba7 · Aug 5, 2026 · 2 filesMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

avoid deleting the backups of same-prefixed wallets

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changeverify proof of work on chain tips and warn when a tip goes staleby Craig Raw · 5ccc4902 · Aug 5, 2026 · 5 filesMessage 60 · AdequateTriage 12Details
Commit message · Craig Raw

verify proof of work on chain tips and warn when a tip goes stale

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changeprevent a password change from re-encrypting wallets whose filenames share the same prefixby Craig Raw · 24c6202e · Aug 5, 2026 · 3 filesMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

prevent a password change from re-encrypting wallets whose filenames share the same prefix

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changereject truncated and oversized tlv lengths when parsing keycard responsesby Craig Raw · b0b9cc23 · Aug 4, 2026 · 2 filesMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

reject truncated and oversized tlv lengths when parsing keycard responses

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Security candidatereject extended private keys when creating a terminal watch only wallet, and show import errorsby Craig Raw · fa0d4841 · Aug 4, 2026 · 2 filesMessage 50 · ThinLow 42Details
Commit message · Craig Raw

reject extended private keys when creating a terminal watch only wallet, and show import errors

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
secret or key materialsigning or wallet path
AI analysis · Low 42/100

This commit fixes a bug in Sparrow Wallet's terminal (command-line) watch-only wallet creation. Previously, a user could accidentally paste an extended private key (xprv) into a dialog meant only for public keys or output descriptors, and the wallet would silently fail or create an empty wallet. Now the app rejects xprv keys with a clear error message and also shows import errors to the user instead of logging them silently.

Routine changeensure imported keystore labels are truncated and uniqueby Craig Raw · 7a3f775a · Aug 4, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

ensure imported keystore labels are truncated and unique

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changealways check and restrict existing wallets and backup directories to owner only permissionsby Craig Raw · 5d387765 · Aug 4, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

always check and restrict existing wallets and backup directories to owner only permissions

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Security candidateadd bitbox02 attestation failed dialogby Craig Raw · 1a810c06 · Aug 4, 2026 · 2 filesMessage 45 · ThinLow 25Details
Commit message · Craig Raw

add bitbox02 attestation failed dialog

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
update trustsigning or wallet path
AI analysis · Low 25/100

This commit adds a user-facing warning dialog when a BitBox02 hardware wallet fails an attestation check. Attestation is a process that helps verify the device is genuine and not a counterfeit or tampered unit. Previously, a failed attestation may not have been clearly communicated to the user. The change improves security by warning users not to store funds on a device that failed verification until they confirm it externally. It is a defensive hardening change, not an active vulnerability fix.

Security candidateimprove validation of payjoin proposals, and accept a substituted payment output where a change output is presentby Craig Raw · 32f7e58f · Aug 4, 2026 · 3 filesMessage 50 · ThinModerate 56Details
Commit message · Craig Raw

improve validation of payjoin proposals, and accept a substituted payment output where a change output is present

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing boundarysigning or wallet path
AI analysis · Moderate 56/100

This commit strengthens how Sparrow Wallet checks Payjoin proposals received from a payment receiver. Payjoin lets a receiver add their own inputs to a transaction to improve privacy. The changes add missing checks that could previously let a malicious or buggy receiver: (1) silently lower the transaction fee rate, (2) add key-path or signature data that leaks wallet information, (3) substitute the payment output even when no change output exists, or (4) return arbitrary error text that the wallet would show to the user. The patch also fixes handling for modern Taproot (P2TR) transactions, which were not being copied or validated correctly. A new set of unit tests confirms these protections.

Routine changeimprove validation of legacy multipart qr part numbersby Craig Raw · 059f1e88 · Aug 4, 2026 · 2 filesMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

improve validation of legacy multipart qr part numbers

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Security candidateremove unused signature verification results in satochip and keycard signers, note where signatures are verifiedby Craig Raw · 866e9893 · Aug 4, 2026 · 2 filesMessage 65 · AdequateInformational 18Details
Commit message · Craig Raw

remove unused signature verification results in satochip and keycard signers, note where signatures are verified

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was security-ranked
signing boundarydefensive validationsigning or wallet path
AI analysis · Informational 18/100

This commit removes leftover code that checked whether signatures from hardware card signers were valid, but then threw away the result. The signatures are still verified later by a different part of the wallet when the signed transaction is combined. The change is essentially a cleanup with no known security flaw, though it slightly reduces defense-in-depth by removing an early, unused sanity check.

Routine changeimprove validation of bip129, descriptor and unchained wallet importsby Craig Raw · 3752540e · Aug 4, 2026 · 29 filesMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

improve validation of bip129, descriptor and unchained wallet imports

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changeadd security policyby Craig Raw · 1a00e2ef · Aug 3, 2026 · 1 fileMessage 33 · OpaqueTriage 0Details
Commit message · Craig Raw

add security policy

33/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was security-ranked
documentation-only discount
Routine changeonly save certificates passing hostname verification as ca validated, and retain not yet valid certificatesby Craig Raw · 372ebf2f · Aug 3, 2026 · 1 fileMessage 60 · AdequateTriage 20Details
Commit message · Craig Raw

only save certificates passing hostname verification as ca validated, and retain not yet valid certificates

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was security-ranked
defensive validationsigning or wallet path
Routine changeremove ineffective eckey clearby Craig Raw · 1636c7e2 · Aug 2, 2026 · 11 filesMessage 35 · OpaqueTriage 12Details
Commit message · Craig Raw

remove ineffective eckey clear

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changeverify fetched transactions match requested txidby Craig Raw · 3979694e · Aug 2, 2026 · 3 filesMessage 55 · ThinTriage 12Details
Commit message · Craig Raw

verify fetched transactions match requested txid

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changerotate era logosby Craig Raw · 2b9c3eb7 · Jul 30, 2026 · 4 filesMessage 28 · OpaqueTriage 12Details
Commit message · Craig Raw

rotate era logos

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changebump to v2.5.4by Craig Raw · ef2c2cde · Jul 30, 2026 · 4 filesMessage 38 · OpaqueTriage 12Details
Commit message · Craig Raw

bump to v2.5.4

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changetreat whitespace-only labels as blank on label import and exportby Craig Raw · 0dce4783 · Jul 29, 2026 · 2 filesMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

treat whitespace-only labels as blank on label import and export

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Security candidateadd option to ignore dust on private key sweepby nroktib · cf797ea0 · Jul 29, 2026 · 1 fileMessage 50 · ThinInformational 19Details
Commit message · nroktib

add option to ignore dust on private key sweep

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was security-ranked
secret or key materialsigning or wallet path
AI analysis · Informational 19/100

This commit adds a user-facing checkbox labeled 'Ignore dust' to the private-key sweep feature in Sparrow Wallet. When enabled, very small ('dust') unspent outputs linked to the swept key are excluded from the transaction. This is a usability and privacy improvement, not a security fix, because dust outputs are often sent by third parties to track wallets or to make sweeps uneconomical due to fees. There is no evidence in the commit or supplied references that this addresses a vulnerability or was disclosed as a security issue.

Routine changealign no usb sp support error message with related exceptionsby Craig Raw · 969dd72d · Jul 28, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Craig Raw

align no usb sp support error message with related exceptions

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Routine changeadd opt-in xdg application directory supportby Craig Raw · 2d667d11 · Jul 28, 2026 · 9 filesMessage 45 · ThinTriage 12Details
Commit message · Craig Raw

add opt-in xdg application directory support

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changefix potential date formatting concurrency issue on backupby Craig Raw · 1b8e9b52 · Jul 24, 2026 · 1 fileMessage 50 · ThinTriage 12Details
Commit message · Craig Raw

fix potential date formatting concurrency issue on backup

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path
Routine changepersistence hardening followupby Craig Raw · aeb0eeb1 · Jul 24, 2026 · 2 filesMessage 35 · OpaqueTriage 20Details
Commit message · Craig Raw

persistence hardening followup

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was security-ranked
defensive validationsigning or wallet path
Routine changeadd support for singlesig era hardware walletby Craig Raw · febece9e · Jul 23, 2026 · 8 filesMessage 45 · ThinTriage 12Details
Commit message · Craig Raw

add support for singlesig era hardware wallet

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was security-ranked
signing or wallet path