Panic Playdate

Classification

Device
Criterion	Value	Proof(s)	Comment
Known hardware tampering	None	[2]	Sealed consumer electronics design, not intended to be opened by the user. No public reports of supply chain tampering.
Known vulnerabilities	Rare	[3]	Runs a minimal, custom OS. All software (OS and games) is curated by Panic, drastically reducing the attack surface. Issues are patched via OTA updates.
Prior attacks	None	[4]	No publicly documented security breaches targeting the Playdate platform.
Updatability	Very common	[5]	The device automatically receives mandatory Over-the-Air (OTA) OS updates. Games are also delivered wirelessly on a schedule.
Category score	2

System
Criterion	Value	Proof(s)	Comment
Authentication with other systems	Full	[6]	Authenticates securely with Panic's servers over Wi-Fi to register the device, download OS updates, and receive games.
Communications	Encrypted with up-to-date encryption	[7]	All communication with Panic's servers for account management and content delivery is encrypted in transit using standard TLS.
Storage	Encrypted with up-to-date encryption	[8]	On-device storage is managed and protected by the proprietary Playdate OS. User account data on Panic's servers is encrypted at rest.
Category score	1

User Authentication
Criterion	Value	Proof(s)	Comment
Account management	Full	[9]	A Panic Account is required to register the device and manage games. This is handled through their central web portal.
Authentication	Secure	[10]	Authentication is handled by the cloud-based Panic Account (password-protected). The device itself does not feature a user-facing lock screen or passcode.
Brute-force protection	Exist	[11]	The Panic Account web portal has standard server-side protections against brute-force login attempts.
Event logging	Access event logged	[12]	Panic logs account access events on their servers for security and auditing purposes, as per their privacy policy.
Passwords	Require change after setup with complexity requirements	[13]	The Panic Account creation process requires a password that meets standard complexity rules.
Category score	1

Grade	A