Developer Beta

What you need

• An ESP32-S3 board (~€5 — buy it anywhere)
• A USB-C cable
• Windows 10/11 — for the Windows client
• Linux / macOS — the Linux CLI, part of the SDK, coming 30 September 2026 (fallback: 30 October)
• Any OS — SDK + Linux CLI, Apache 2.0, on GitHub
• 15 minutes to flash and activate

We do not ship hardware during the beta. You source the ESP32-S3 yourself. That is intentional — the whole point is that any commodity chip becomes a Crypt-in dongle.

Hardware of the beta

Beta dongles run Secure Boot v2 and Flash Encryption active— identical to the dongles of the public launch. There is no reduced version for the beta, and no dongle in a tester's hands is left unburned.

Flashing is what burns them. The moment the Crypt-in firmware is written to your ESP32-S3 the eFuses are burned: lake8.dev secure boot key, flash encryption, JTAG permanently disabled. From that point the board is a Crypt-in dongle with exactly the protections a launch unit has.

Burning eFuses is irreversible. Use a board you are willing to dedicate to Crypt-in: after the first flash it does not go back to being a general-purpose ESP32-S3, it will not accept unsigned firmware, and read-flash is refused. That is the point — but it is worth knowing before you connect the €5 board you were using for something else. Details in the flash guide and the security model.

Hardware that works

Any ESP32-S3 board with a native USB-C OTG port works. This is what we develop and test on, and where it ends up.

You are the red team

Every Crypt-in beta participant is officially part of our security program.

Before this beta we ran three red team sessions using Claude Opus 5, with full source access, DnSpy, admin rights and a live dongle. We published everything — every attack, every byte of response, every finding.

Read the full red team report →

Your mission

• Read the red team report before you start
• Try every attack described
• Try attacks we haven't described
• Report findings to security@lake8.dev

What we want to hear

"I broke it" — tell us how.
"I couldn't break it" — tell us that too.

Both answers are valuable.

Finding acknowledgement

The most significant finding reported during the beta period will be acknowledged by name in the Q1 2027 public launch security report.

Three red team sessions ran before this beta — session 4 is this beta. The findings from the developer beta will be incorporated into the Q1 2027 public launch security report, alongside any fixes applied before launch.

Report security findings → security@lake8.dev

Known limitations

• Anti-rollback is not implemented. A downgrade to a previous signed firmware version is possible. Unsigned firmware never runs — Secure Boot v2 is active on every dongle. Fix: before the Q1 2027 public launch, together with the OTA update mechanism.
• Session binding is not implemented. An unlocked dongle exposes the decrypt oracle to any process on the machine — finding F-001-REV, still open. Fix: Q2 2027, with the WiFi firmware release — after the public launch. See the red team report.

We tell you where the wall is low, so you know where to put the guard. Response times, the disclosure process and the PGP key are on the responsible disclosure page.

What you get — free for the entire beta

No credit card. No payment during the beta. Free automatic renewal while the beta continues; standard €30/year when the beta ends.

The source repository is private today and there is no public channel before 30 September 2026. Beta participants get access through dedicated channels at launch. What is public right now are the specifications: the HID protocol and the .crin format are documented in full, in enough detail to write an independent client.

How the beta licence works

Beta licence terms. There is an expiry — it renews itself free while the beta runs.

• Your beta licence is valid for 6 months from activation.
• If the beta continues beyond 6 months, your licence is extended automatically and free of charge for another 6 months.
• When the beta ends, your licence expires.
• To continue using Crypt-in after the beta: renew at the standard rate of €30/year.
• You never pay anything during the beta — guaranteed.

Expiry gates new encryption only. Files you have already encrypted stay decryptable forever with your dongle, licence or no licence.

Downloads

Full transparency: every component of the firmware and of the CLI is declared in the Software Bill of Materials → — SPDX 2.3, one document per artefact, published before the binaries ship. The Windows client, Personal v1, has no SBOM of its own yet.

Getting started

1. Buy an ESP32-S3 (~€5 on AliExpress, Mouser, Amazon)
2. Flash the firmware — flash guide
3. Download the Windows client, or clone the SDK and build against it
4. Activate your free beta licence (6 months, renewable)
5. Start encrypting files

First boot generates your keys — on your hardware, in your hands. We never see your seed. The full sequence is documented.

Feedback

Beta testers get direct access to the developer.

• Email info@lake8.dev with the subject [BETA] your topic
• Found a security issue? security@lake8.dev, under the disclosure policy

Beta terms

• Beta software may have bugs. Back up your data.
• Flashing burns the eFuses. Secure Boot v2 and Flash Encryption are activated on your board irreversibly, exactly as on a launch dongle.
• The beta licence is valid for 6 months from activation.
• If the beta continues beyond that, all beta licences are renewed automatically and free of charge, via the standard renewal process.
• You will never pay during the beta phase.
• Pricing activates at public launch for new activations only — existing beta users are never charged retroactively.
• Your feedback shapes the final product.
• No NDA required. You can write about it publicly.

Security testing

By participating in the Crypt-in beta, you acknowledge that:

• You have read the red team report
• You understand the declared limits
• You are participating as a security tester, not just an end user
• Any finding you report will be handled throughresponsible disclosure
• lake8.dev will acknowledge your contribution if your finding leads to a fix

By participating in the beta you accept the lake8.dev Terms of Service and Privacy Policy.