feuristic v0.1.0

feuristic: a security key for your Trezor Safe 3

Open-source firmware that turns a Trezor Safe 3 (T2B1 or T3B1) into a USB
security key. These are optimized release builds without debuglink, verified
against three reproducible Nix builds per model.

• Passkeys you can back up. Unlike a YubiKey, you can save your passkeys in
  an encrypted QR backup and restore them onto a Safe 3 running feuristic.
• See what you approve. The screen names the site before you confirm.
• 2FA codes on the device. TOTP/HOTP accounts imported from a QR image.
• SSH, Git and email. OpenSSH ed25519-sk keys, OpenPGP card for GnuPG,
  PIV, AES-256-GCM. Menus in English and French.

Which file do I need?

Run trezorctl get-features and read the internal model:

Internal model	Download
T2B1	feuristic-<version>-T2B1-<commit>.bin
T3B1	feuristic-<version>-T3B1-<commit>.bin

Verify SHA256SUMS, then follow the
installation guide.

Before you install

• Installing erases the wallet. Back up your recovery seed first.
• The bootloader unlock is one-time and irreversible. It removes Trezor's
  genuine-device attestation, and the standard UNSAFE, DO NOT USE! boot
  warning appears.
• This independent project is not made or signed by Trezor Company / SatoshiLabs.
• Core features passed a physical T2B1/macOS campaign.
  T3B1 hardware, Windows/Linux and camera restores are still being tested.
  Keep a second way to sign in to important accounts.

Release contents

Both images, SHA-256 sidecars, SHA256SUMS, an SPDX SBOM, PROVENANCE.json
and the corresponding source archive with dependency licenses. The images use
upstream's public development signing keys and the provisional USB identity
1209:0001. See the changelog
for changes and the security policy
for private vulnerability reporting.

Feuristic v0.1.0-dev

Feuristic development candidate

Custom firmware for Trezor Safe 3 T2B1 and T3B1. Independent project,
not made or signed by Trezor Company / SatoshiLabs. Installing requires an
irreversible bootloader unlock and erases the wallet and manufacturer attestation.

• FIDO2 passkeys, OpenPGP, PIV, TOTP/HOTP, AES-GCM and encrypted QR backups.
• Visible FEURISTIC welcome screen and corrected TOTP countdown.
• Initial physical T2B1/macOS campaign: FIDO, OpenPGP, PIV, AES, OTP and persistence.
• Full R01–R16, T3B1 hardware and remaining host combinations are not qualified.
• Public development signing keys and provisional USB identity remain in use.

Download the image matching the internal model, verify SHA256SUMS, then follow
installation.
Do not use production identities. The bootloader warning remains.

This workflow runs the complete CI suite and compares three Nix builds per
model before creating the draft. PROVENANCE.json records source and build
references. The source archive includes patched upstream sources and dependency
licenses; the SPDX SBOM records included components. Review the linked workflow
run for the exact automated results and the
hardware report
for the physical test scope.

For vulnerabilities, use private reporting
and read the current security policy.

Host tooling update (22 October 2026): the source archive preserves the original
uv.lock, which includes a certifi version affected by
GHSA-6q48-6c7w-9gw2.
For host-side development and builds, use current main and its documented
upstream preparation procedure. It updates certifi in both host environments,
including the upstream build environment’s package-delay exception.
The firmware does not embed certifi. Published binaries and their original
checksum/build records remain unchanged.