ColdCard is not open source which was exactly part of the problem. Open Source and Source Verifiable code are *not* the same and don’t offer similar benefits in terms of community involvement, more eyes reviewing, and more people building on that code.
https://dtvelectronics.com/source-available-software-is-it-dangerous/
