QRL’s postmortem on the COLDCARD RNG bug, reduced entropy, seed risk, and the usual reminder that open source still needs review.