[a1a1a1a1a1a1]

This seems like a legitimate concern. I didn't see any indication that the snowcone presented a code that would be verified through the aws opshub application, or a similar operation. Is this happening behind the scenes, maybe in the manifest file you upload?

If this was swapped in shipping it could potentially just work as expected while exfiltrating data whenever it could connect to the internet, potentially through builtin lte, etc.