Recipient
6-digit code or a QR code on the phone. The locker compares HMAC hashes. The code is set when the parcel is loaded and never changes afterwards.
Security
Parcel locker security model
Goal: even with full control of the cloud, meaning the server, the database and an admin account, nobody can open an occupied door. The locker checks every opening itself, without internet.
Who can open a door, and with what
The locker trusts only the keys in its trust file, copied during installation and never sent through the cloud. The operator root key is kept offline.
Sender
8-digit code. It opens free doors only.
Courier load
QR token signed by the cloud key. A load opens empty doors only and cannot change a parcel that is already inside.
Courier collection
QR token signed by the carrier's device key, certified from the operator root key. The cloud cannot forge it.
Technician
Service token signed by a certified technician device key.
Support, remote open
Operator passkey plus the code shown on the locker screen. Without the code it takes two different people with two different keys. At most 3 per hour.
RS485
Lock bus guard
Most lock boards do not authenticate commands. Anyone who reaches the RS485 wires can open doors with a cheap adapter. The locker is the only legitimate master on the line, so it treats anything it did not ask for as suspicious.
- Service panel openedThe panel switch reports open and no service token was used in the last 30 minutes.
- Foreign trafficBytes on the line when the locker sent no request, or replies to requests it never made.
- Noise3 or more corrupted replies within a minute.
- Inserted relay device5 replies in a row slower than 3 times the normal time plus 25 ms.
- Forced doorA door sensor reads open although the locker did not open that door in the last minute.
- Cut cableAll boards that used to answer go silent at once. The event lists the doors with parcels.
What happens next
The parcel behind a forced door is held: its code stops working and the door stays occupied until a courier collects it. After foreign traffic or a forced door, the locker switches off coils that boards hold on. The cloud opens an intrusion or anomaly alert and sends a webhook. All of this works with existing boards.
What the guard cannot do
The guard detects an attack, it does not stop it. Behind a cut cable the locker cannot see until the link is restored. Without a panel switch, opening the panel is invisible. Only a board that checks command signatures can block the attack itself.
Hash-chained evidence log
Every locker event is linked to the previous one with SHA-256. The cloud checks the chain when it receives events and raises an alert if it breaks. A record cannot be changed or removed unnoticed, which makes the log usable as evidence in disputes.
Signed updates
Only the release key in the locker's trust file can sign an update, never the cloud key. The locker checks the signature, SHA-256 and size, rejects older versions, and restores the previous version if the new one fails to start.
Backend protections
- Each locker connects over mTLS with its own certificate, valid for that locker only
- One-time registration code, valid for 24 hours, stored only as a hash
- Admin passwords with argon2id, roles, CSRF and Origin checks, CSP
- 5 failed logins lock the account for 15 minutes, per IP and per account and IP
- API keys stored as hashes, with scopes and a limit of 10 requests per second
- Webhooks over HTTPS only, private addresses blocked at connect time, no redirects
- Recipient codes never reach the server in links: they stay in the URL fragment
- Card data never reaches our system: payment runs on the provider's page
Remaining risks, stated plainly
Recipient codes in the cloud
The cloud generates codes and sends the SMS, so a breached cloud could learn them. Each code works only in person at the locker, one at a time, with camera and log records, and the keypad locks after 5 errors. There is no mass remote opening.
Physical attacks
Software cannot stop someone breaking the cabinet. The bus guard detects it and the parcels involved are held.
Other makers' lockers
Lockers listed from another maker's cloud are read-only and marked as not covered by these guarantees.
Key storage
Keeping root keys in an HSM or smart card and the locker TLS key in a TPM is on the roadmap for production installs.
Independent review
An internal security review in November 2026 covered recalled parcels, code storage, the two-person rule, downgrade attacks, token replay after reboot, tenant isolation, login abuse and webhook SSRF. Every finding is fixed and documented.
Test the attacks yourself
The demo locker has thief tools: a foreign open command, line noise, a relay device, a cut cable and a service panel. Watch what the guard reports.