My threat model takes into account people who act like experts but aren't.

BitBox Blog

Coldcard isolation bypass

Responsible disclosure of a Coldcard vulnerability that allows an attacker to spend your bitcoins when you think you are signing a testnet transact...

Vulnerable AF, this wouldn't be acceptable if any other "brand" has this going after so many years in biz. They didn't pay a single bounty, fuggin shady fucks.