Fake open source, true open source, reproducible open source, and continuous cross-auditing are four distinct levels of concepts. Claiming to be open source but having no public repository on GitHub, or only open-sourcing part of the SDK, is fake open source. Complete open source of all software and firmware code, with developers continuously submitting commits in the same repository, making all changes traceable and visible, is true open source. On the basis of true open source, if anyone can pull the code and locally build a version identical to the official one, even with matching signature hash values, that’s reproducible. For every major version iteration, providing at least two independent audit reports over several years is continuous cross-auditing. - Can transactions be verified and confirmed directly on the device? NFC card wallets clearly can’t. - Is the source code publicly available? - Is the decompiled binary clear and readable? - Is the private key truly generated offline? - Is the private key generated using a genuine TRNG (True Random Number Generator), and is there a risk of collision? Before purchasing any hardware wallet, keep asking these questions until you find the real answers.