SafePal says an authorization flaw in an order-tracking plug-in exposed identity, contact, shipping and purchase data for approximately 39,798 customers. The disclosure did not report compromised wallet secrets, but it shows why purchase data belongs inside a wallet provider's security boundary.
July and August 2026 exposed two different security failures: predictable wallet-secret generation and weak control of customer fulfillment data. The durable response is operator-inaccessible vault secrets plus purpose-specific minimum retention for unavoidable business records.
Software may shape the interface, but silicon, firmware, manufacturing, and device lifecycles determine who ultimately controls a connected system. This analysis traces the American and Chinese hardware-intelligence playbooks—and the commercial race to rebuild trusted infrastructure.