Sparrow Wallet PR #2047: warn on COLDCARD device selection
sparrow-pr-2047
Latest reviewed change
source content difference between and
The pull request gained a follow-up comment clarifying which COLDCARD selection surfaces show the warning, and another comment proposing a load-time acknowledgment or MOTD feature.
7df4cea
….1.9, add Mk5)
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
+nrobi144
+commented
+Aug 10, 2026
+Copy link
+Copy Markdown
First lines only. The complete diff is in the timeline below.
- Organisation
- Sparrow
- Evidence role
- Repository pull request
- Published
- 2026-08-06
- Source changes
- 1
- Detected differences
- 2
- Unreviewed
- 0
- Copies held
- 3
A third-party proposal in Sparrow Wallet to show an advisory warning when a user selects a COLDCARD in the device flow, opened 6 Aug 2026 by nrobi144 and approved by skwp the same day. Held because wallet software warning its own users is a distinct strand of the response from vendor advisories and upstream library fixes: it puts the notice where a person is about to use the device. Detection keys on the exact COLDCARD wallet model, so subclassing importers do not trigger it. The author states the change was drafted with LLM assistance and that he could not run a full local build.
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
The pull request gained a follow-up comment clarifying which COLDCARD selection surfaces show the warning, and another comment proposing a load-time acknowledgment or MOTD feature.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 28 lines
7df4cea ….1.9, add Mk5) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> +nrobi144 +commented +Aug 10, 2026 +Copy link +Copy Markdown +Author +Good question @PrinceOfEgypt. This PR hooks TitledDescriptionPane, so the warning shows across every Coldcard selection/import surface (file/QR import, airgapped keystore, USB, export) — but you're right that it does not fire when an already-created Coldcard wallet is simply opened/loaded. +A load-time acknowledgment (e.g. "I confirm I regenerated a secure seed on fixed firmware or with ≥50 verified dice rolls") is a good idea, but it's a meaningfully larger change — persisted per-wallet acknowledgment state + a dialog/banner in the wallet-open path — and I'd want it built and tested locally before proposing it (I flagged in the PR that I couldn't run a full Gradle build here). Happy to open it as a separate follow-up if @craigraw thinks the load-time prompt is worth adding; this PR keeps the scope to the additive, low-risk selection-time warning. +<github-reactions> +Sorry, something went wrong. +Uh oh! +There was an error while loading. Please reload this page. +PrinceOfEgypt +commented +Aug 10, 2026 +• +edited +Loading +Uh oh! +There was an error while loading. Please reload this page. +Copy link +Copy Markdown +Contributor +I agree, it's a larger change, but given the real risk of fund loss I think it's valuable (and probably the "right thing" to do). I unfortunately can't work on a PR myself at the moment because of some work deadlines.. we'll see what @craigraw thinks. Another idea I had was something like a "MOTD" type feature where urgent messages could be shown to users when they launch sparrow.. but that would require backend infrastructure and other changes +All reactions +Sorry, something went wrong. +Uh oh! +There was an error while loading. Please reload this page. This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters Show hidden charactersExtracted text as captured
Skip to content Navigation Menu Sign inAppearance settings Platform AI CODE CREATION GitHub CopilotWrite better code with AI GitHub Copilot appDirect agents from issue to merge MCP RegistryIntegrate external tools DEVELOPER WORKFLOWS ActionsAutomate any workflow CodespacesInstant dev environments IssuesPlan and track work Code ReviewManage code changes Code QualityEnforce quality at merge APPLICATION SECURITY GitHub Advanced SecurityFind and fix vulnerabilities Code securitySecure your code as you build Secret protectionStop leaks before they start EXPLORE Why GitHub Documentation Blog Changelog Marketplace View all features Solutions BY COMPANY SIZE Enterprises Small and medium teams Startups Nonprofits BY USE CASE App Modernization DevSecOps DevOps CI/CD View all use cases BY INDUSTRY Healthcare Financial servicesExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
Skip to content Navigation Menu Sign inAppearance settings Platform AI CODE CREATION GitHub CopilotWrite better code with AI GitHub Copilot appDirect agents from issue to merge MCP RegistryIntegrate external tools DEVELOPER WORKFLOWS ActionsAutomate any workflow CodespacesInstant dev environments IssuesPlan and track work Code ReviewManage code changes Code QualityEnforce quality at merge APPLICATION SECURITY GitHub Advanced SecurityFind and fix vulnerabilities Code securitySecure your code as you build Secret protectionStop leaks before they start EXPLORE Why GitHub Documentation Blog Changelog Marketplace View all features Solutions BY COMPANY SIZE Enterprises Small and medium teams Startups Nonprofits BY USE CASE App Modernization DevSecOps DevOps CI/CD View all use cases BY INDUSTRY Healthcare Financial servicesExcerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
1 presentation-noise difference. Sidebar, ticker and other page chrome churn that our review classified as not being a change to what the source says.
- +5 -3 Only GitHub header chrome changed. The 'Sign in' and 'Appearance settings' labels split onto separate lines, and the search prompt changed from 'Type / to search' to 'Search/'. The pull request content was unchanged.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.