DCENT_Toolbox is a security tool. It includes exploit, unlock, credential-recovery, EEPROM, and firmware-audit capabilities. With that power comes responsibility — both yours and ours. This document covers how to use the tool legally, what we expect of you, and how to report a vulnerability in the tool itself.

The unlock, exploit, credential, and flashing features in this tool are intended solely for hardware you own or are explicitly authorized in writing to administer. Pointing them at miners you do not control — to gain access, recover credentials, or alter firmware — is illegal in most jurisdictions and is never something we condone.

By using DCENT_Toolbox you agree that:

• You are the owner of the target hardware, or you have explicit authorization to test it.
• You accept full responsibility for how you use the tool.
• The software is provided as-is, without warranty of any kind, to the extent permitted by the GPL-3.0 (see LICENSE, sections 15–17). D-Central is not liable for damage to hardware, loss of data, or any consequence of use or misuse.

The techniques DCENT_Toolbox implements are based on publicly documented research, published CVEs, and independently reverse-engineered protocols. Publishing this code lets owners audit and repair their own equipment, and lets security researchers review what the tool actually does. We believe transparency serves miners better than leaving these capabilities to private, unaudited tooling.

DCENT_Toolbox can audit certain closed-source, third-party miner firmware for hidden backdoors, phone-home telemetry, remote-access vulnerabilities, and silent dev-fee redirection — and remove them from hardware you own. These are defensive capabilities: they help an owner understand and clean firmware running on their own miner. We describe what the tool detects and removes; we don't publish exploitation walk-throughs against any named vendor.

DCENT_Toolbox contains and uses cryptographic functionality (AES, RSA-signature handling, XXTEA, and related research code). Depending on where you live, downloading, using, or redistributing cryptographic software may be subject to export-control or import regulations. It is your responsibility to comply with the laws applicable to you.

If you find a security flaw in DCENT_Toolbox itself — something that would let it harm a user, leak their data, or act against their intent — we want to hear about it.

Please do not open a public GitHub issue for security vulnerabilities.

Email security@d-central.tech with:

• A description of the issue and its impact.
• Steps to reproduce (and a proof-of-concept if you have one).
• The affected version / commit and your OS + Python version.
• How you'd like to be credited (or if you prefer to stay anonymous).

If you need to encrypt, request our PGP key in your first email and we'll provide it.

• The tool acting destructively without the --yes / explicit confirmation it promises.
• A proof-ladder violation — the tool reporting a stronger outcome than it proved (e.g. claiming a flash "completed" on a timeout, or "verified" without checking).
• Credential or key leakage by the tool — secrets written to logs, diagnostic bundles, or stdout that should have been redacted/masked.
• An unlock or install path that bricks a unit where a safe path existed, or that bypasses a fail-closed safety gate (degraded-hardware refusal, retired-unit block, EEPROM write-protection).
• Supply-chain issues: a tampered dependency, or the on-demand firmware download accepting a package that fails its SHA-256 pin.

• Acknowledgement: within 3 business days.
• Triage & assessment: we'll confirm the issue and assess severity, and keep you updated.
• Fix & disclosure: we aim to ship a fix promptly and will coordinate a disclosure timeline with you. We're happy to credit you in the release notes.

In scope: the dcent_toolbox Python package, its CLI/TUI, and its install/flash/OTA tooling in this repository.

Out of scope: vulnerabilities in third-party miner firmware (those are the vendors' to fix — the tool's job is to detect/clean them on hardware you own); the BraiinsOS boot components the install path downloads from the upstream Braiins feed; and the inherent fact that an unlock tool can unlock hardware (that's the feature — "authorized use only", above, governs it).

We will not pursue or support legal action against researchers who, acting in good faith, find and report flaws in DCENT_Toolbox itself, follow this policy, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.

Security contact: security@d-central.tech · D-Central Technologies Inc., Laval, Québec.