Every commit scored for change-risk against this repo's own history, so 'elevated' means elevated here rather than on some global curve.
Needs review
19 commits sit in this repo's top risk tercile, which is 33% of the 57scored. The cut is drawn against this codebase's own history rather than a global curve, so a quiet repo still fills its top band, and here it starts at 8.0 out of 10. What pushes a commit up is size and spread together: a large change confined to one area scores below a smaller one scattered across a dozen files.
Commit categories over time, read off the subject line. Fixes carry the accent because that is the series this chart exists to show.
Consistently other-driven across its history.
Ranked by change-risk, highest first. Priority is a tercile of this repo's own distribution, so a quiet repo still fills its top band.
| # | Commit | Author | When | Lines | Review priority | Top driver |
|---|---|---|---|---|---|---|
| 1 | 3e545471feat: first release (#3) | Arash Afshar | 1y ago | +267.9K -1 | 99thElevated | — |
| 2 | 2e1ca104feat: introduce C++ and C API layers with header reorganization (#99) | Yi-Hsiu Chen | 5mo ago | +37.7K -18.5K | 96thElevated | — |
| 3 | c7b470adfeat: Revamp Go wrapper (#31) | Yi-Hsiu Chen | 1y ago | +11.9K -2.3K | 96thElevated | — |
| 4 | ba33d3dcfix: harden crypto helpers and add coverage tooling (#121) | Yi-Hsiu Chen | 1mo ago | +5.3K -654 | 93thElevated | — |
| 5 | cc4265d3feat: Pluggable KEMs, Distributed Decryption, and Core Hardening (#45) | Yi-Hsiu Chen | 11mo ago | +4.9K -2.1K | 93thElevated | — |
| 6 | d611643dfeat: optimize Ed25519 point storage (#15) | Yi-Hsiu Chen | 1y ago | +1.3K -1.4K | 90thElevated | — |
| 7 | 99ecc499fix: harden Paillier validation, fix buf_t aliasing, and add bn256_t … (#103) | Yi-Hsiu Chen | 5mo ago | +1.8K -101 | 89thElevated | — |
| 8 | 82e26913fix: constant-time hardening and input validation across crypto primitives (#88) | Yi-Hsiu Chen | 7mo ago | +875 -403 | 86thElevated | — |
| 9 | ce67bec4feat: Add EdDSA threshold signing tests (#51) | Yi-Hsiu Chen | 10mo ago | +586 -2 | 86thElevated | — |
| 10 | 3aced93dfeat: Implement RFC 5869 HKDF and RFC 9180 DHKEM(P-256) (#58) | Yi-Hsiu Chen | 10mo ago | +459 -8 | 82thElevated | — |
| 11 | ee61f1f2fix: enable flexible t-of-n cryptogrpahic operations (#29) | Yi-Hsiu Chen | 1y ago | +605 -174 | 82thElevated | — |
| 12 | 3a2f7c22fix: harden serialization validation and restrict supported platforms (#122) | Yi-Hsiu Chen | 1mo ago | +607 -132 | 79thElevated | — |
| 13 | a8ee24c6feat: add ML-KEM-768 and extend bn256_t/DRBG/RO primitives (#115) | Yi-Hsiu Chen | 3mo ago | +411 -31 | 79thElevated | — |
| 14 | 44d3ccf0refactor: extract FFI memory adapters into separate cbmpc/ffi module (#75) | Yi-Hsiu Chen | 8mo ago | +371 -384 | 76thElevated | — |
| 15 | f36b0097fix: security hardening for ZK proofs and protocol input validation (#84) | Yi-Hsiu Chen | 7mo ago | +187 -36 | 75thElevated | — |
| 16 | 33f98c96feat: Add constant-time curve operations and enhancements (#68) | Yi-Hsiu Chen | 8mo ago | +135 -46 | 72thElevated | — |
| 17 | 032abd77chore: Add usage notes to core functions (#20) | Yi-Hsiu Chen | 1y ago | +122 -6 | 72thElevated | — |
| 18 | 0460152bfix: harden additive share reconstruction (#114) | Yi-Hsiu Chen | 3mo ago | +163 -75 | 68thElevated | — |
| 19 | 557708c6chore: general security and safety improvements (#69) | Yi-Hsiu Chen | 8mo ago | +137 -179 | 68thElevated | — |
| 20 | 2cfa5da2fix: make MODULO macro safe for early returns and nesting via RAII scope guard (#107) | Yi-Hsiu Chen | 4mo ago | +104 -23 | 66thTypical | — |
| 21 | 231b02ecrefactor: Consolidate threshold DKG logic into key_share_mp_t (#55) | Yi-Hsiu Chen | 10mo ago | +95 -28 | 62thTypical | — |
| 22 | 87906c7frefactor: Crypto hardening and code cleanup (#36) | Yi-Hsiu Chen | 1y ago | +118 -98 | 62thTypical | — |
| 23 | 9883f8ddbuild: Use clang20 and clang‑format (#22) | Yi-Hsiu Chen | 1y ago | +136 -83 | 62thTypical | — |
| 24 | 270f9e96fix: Keep PVE decrypt searching after row failures (#109) | Yi-Hsiu Chen | 3mo ago | +104 -2 | 59thTypical | — |
| 25 | ec9a818ffix: Prevent buffer overflow in converter (#54) | Yi-Hsiu Chen | 10mo ago | +92 -311 | 57thTypical | — |
| 26 | 245fe04d[StepSecurity] Apply security best practices (#27) | stepsecurity-app[bot] | 1y ago | +47 -10 | 55thTypical | — |
| 27 | 085d71b9build: Improve OpenSSL build process and fix on macOS (#52) | Yi-Hsiu Chen | 10mo ago | +90 -12 | 54thTypical | — |
| 28 | 3217a88bdocs: expand README with deployment/API guidance and fix spec typo (#102) | Yi-Hsiu Chen | 5mo ago | +75 -2 | 52thTypical | — |
| 29 | 5d3774cfrefactor: demo code rearragement (#30) | Yi-Hsiu Chen | 1y ago | +79 -77 | 50thTypical | — |
| 30 | 1ce3207bchore: Add benchmark for vartime curve operations (#21) | Yi-Hsiu Chen | 1y ago | +39 -8 | 48thTypical | — |
| 31 | dc7ce215chore: cleanup (#5) | Arash Afshar | 1y ago | +38 -40 | 46thTypical | — |
| 32 | 6493b1dffix: Correct benchmark function references, entropy seeds (#72) | Yi-Hsiu Chen | 8mo ago | +28 -16 | 45thTypical | — |
| 33 | d2a3b9b3chore: Enhance protocol validation and link to specs (#60) | Yi-Hsiu Chen | 9mo ago | +29 -10 | 42thTypical | — |
| 34 | 056e00ccfeat: Add msg size to Full-OT bench (#34) | Yi-Hsiu Chen | 1y ago | +28 -25 | 42thTypical | — |
| 35 | 225d6796fix: Zeroize plaintext on AES-GCM decryption failure (#17) | Yi-Hsiu Chen | 1y ago | +24 -21 | 39thTypical | — |
| 36 | e97eec7bfix: bound modulus buffers and OpenSSL install paths (#117) | Yi-Hsiu Chen | 3mo ago | +44 -12 | 38thTypical | — |
| 37 | 23a6e9abbuild: Improve OpenSSL discovery and linking (#49) | Yi-Hsiu Chen | 11mo ago | +24 -7 | 36thTypical | — |
| 38 | 7bca8268bench: Add curve check benchmark and improve benchmark practices (#74) | Yi-Hsiu Chen | 8mo ago | +24 -16 | 34thTypical | — |
| 39 | 7aaae86cbuild(deps): bump golang.org/x/crypto from 0.38.0 to 0.45.0 in /demos-go/cmd/threshold-ecdsa-web (#65) | dependabot[bot] | 9mo ago | +15 -15 | 32thBelow typical | — |
| 40 | 50522e0dfix: Prevent Out-of-Bounds read in PVE (#57) | Yi-Hsiu Chen | 10mo ago | +18 -0 | 30thBelow typical | — |
| 41 | bc1d560efeat: Prevent null dereference in cgo constructor (#50) | Yi-Hsiu Chen | 10mo ago | +21 -11 | 30thBelow typical | — |
| 42 | a87e6736refactor: Move test-only ElGamal check functions to test file (#71) | Yi-Hsiu Chen | 8mo ago | +12 -17 | 27thBelow typical | — |
| 43 | 047a698achore: cleanup unused codes in buf128_t and buf256_t (#26) | Yi-Hsiu Chen | 1y ago | +10 -146 | 25thBelow typical | — |
| 44 | 4360c209chore: Address ASan and UBSan findings (#18) | Yi-Hsiu Chen | 1y ago | +9 -5 | 24thBelow typical | — |
| 45 | c9daa4bcbuild(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in /demos-go/examples/ecdsa-mpc-with-backup (#66) | dependabot[bot] | 9mo ago | +4 -4 | 22thBelow typical | — |
| 46 | 0b34dc6fchore: update release workflow to use semantic version tags (#89) | Yi-Hsiu Chen | 7mo ago | +5 -5 | 19thBelow typical | — |
| 47 | 12c001cc[StepSecurity] Apply security best practices (#76) | stepsecurity-app[bot] | 8mo ago | +4 -4 | 19thBelow typical | — |
| 48 | 4004152bbuild(deps): bump github.com/go-viper/mapstructure/v2 (#39) | dependabot[bot] | 1y ago | +3 -3 | 16thBelow typical | — |
| 49 | f1e24c79build(deps): bump github.com/go-viper/mapstructure/v2 (#32) | dependabot[bot] | 1y ago | +3 -3 | 16thBelow typical | — |
| 50 | 21ce39a2Run CodeQL on push to master (#4) | bthornton-cb | 1y ago | +3 -1 | 13thBelow typical | — |
Two views of the same model: where the cuts fall, and what commit shape lands you above them.
Every scored commit, binned on the raw 0 to 10 score rather than the percentile. Percentile ranks are uniform by construction, so that axis has no shape to draw. The dashed lines are the tercile cuts behind each row's priority pill.
The 57 most recent commits, on their own recency sample rather than the feed above: that defaults to risk-sorted, so reusing it would plot only the top tercile and call it the spread. Big and scattered is what the model penalises. Click a dot to open it.
Repowise tracks change history across 773 files in coinbase/cb-mpc. In the last 90 days 104 files were touched, 132 times in total, most often base_ecc.cpp. Every commit is scored for change risk from its size, spread and the history of the files it touches.
