-snip-
there is a thing called responsible disclosure. They disclose their findings to the company and its developers. The company then has time to investigate the findings and patch the issues. Only after weeks or months and after a fix has been released for the users, will the company release information about what happened and why there is a need to update.
Responsible disclosure may be like a Bug Bounty or even if it is not written that the hardware wallet company that gets information about the latest bug should also reward users who disclose some of the bugs they find.
But some uninformed companies don't even provide any rewards to individuals or communities that help develop their software and hardware wallets.
I'm not sure if that's the norm with the customs in your country, but it's worth noting that SafePal has an authentication mechanism on its devices.
- Unfortunately, I don't think you can ask for a replacement or a refund if it fails the authentication part.
Supposedly, if it is indeed opened, it is only limited to seeing if it is really the same item as on the packaging, because such checks are often carried out by customs,
but some also only look at it from an X-ray camera without the need to open the seal.
Safepal S1 or other safepal hardware does have device authentication when a new device is opened and turned on,
it will display a QR Code that directs the user to verify the 6-digit code generated by the safepal device randomly.
This is done to validate the original device or have been used before,
because if the device has been activated before, it will only appear in the main menu by asking for a PIN Code