Amazon Fire TVs have a decently robust set of parental controls to help lock the streaming device down from curious kids. Thousands, if not millions, of parents have likely set up a Fire TV for their kids with an assortment of safe apps and appropriate settings and then confidently enabled parental controls with reassurance that nothing their little one does will break out of the walled garden they’ve just created. Unfortunately, there are two pretty big holes in the Fire TV’s parental controls that can not only give someone without the seemingly necessary PIN code access to all sorts of unfavorable content but also the ability to render the entire device unusable.

There are two distinct options for parents to restrict app and content access on Fire TVs. The first option is to create a separate kids profile which, when selected, puts the entire device into a sandboxed mode where only select apps and content can be accessed. While this is the safest approach, and avoids the parental control holes I’ll be discussing shortly, it requires a PIN to be entered every time the Fire TV is used, and switching between regular profiles and kid profiles is excruciatingly slow, especially on older Fire TV models.

The second, much more convenient option, for locking down a Fire TV that is used by both kids and adults is to stick to regular non-kid profiles, or even just a single profile for everyone to use, and to PIN protect certain content and actions in the Fire TV’s parental control options. This, more commonly used approach for locking down a Fire TV, is where the holes exist.

After installing an assortment of child-safe apps and setting available parental control options within those apps, I expect that most people who enable parental controls on their Fire TV will PIN protect purchases and mature-rated content but will not PIN protect app launches. Since having parental controls enabled will prevent new apps from being installed and the already installed apps are either safe or locked down with in-app parental controls, there’s no need to require a PIN to launch apps.

This is where the first hole exists in the Fire TV’s parental controls. While enabling parental controls prevents the installation of all-new apps from being installed unless a PIN is entered, it does not prevent previously installed “cloud” apps from being installed. So, any app you’ve purchased/installed in the past can, at any time, be selected and installed on any of your Fire TVs without needing to enter a PIN, even if you have parental controls enabled.

The only way around this hole, other than using kid profiles, is to PIN protect all app launches or delete previously installed apps from your list of cloud apps. If an app is not in your list of cloud apps, trying to install it will be treated as a purchase even if it’s a free app, so PIN protecting purchases with parental controls will prevent an all-new app from being installed without knowing the PIN. However, if the app has already been purchased in the past, then the Fire TV doesn’t treat it as a new purchase, so only PIN protecting app launches will prevent installing and launching a cloud app.

While deleting cloud apps from your account will keep old apps you no longer use from making their way onto Fire TVs that have parental controls enabled, it’s not an option for apps that you want to have installed on some of your Fire TVs but not on others. So, you must either PIN protect all app launches or use kid profiles if you truly don’t want certain apps from being installed on a Fire TV with parental controls enabled because a savvy kid can install any app in your cloud library without a PIN.

Even though installing apps isn’t as restricted as you may have thought when parental controls are enabled, at least all the potentially damaging Fire TV Settings are protected behind a PIN, right? Wrong. There’s one option in the Fire TV’s settings that can be accessed without a PIN while parental controls are enabled, which some would say is the most damaging.

The second big hole in the Fire TV’s parental controls is the ability to factory reset any Fire TV without entering a PIN. With parental controls enabled, you can navigate to the “My Fire TV” menu in the Fire TV’s Settings and select “Reset to Factory Defaults.” As you would expect, you’ll be immediately asked to enter your PIN. However, if you back out of the PIN entry screen and keep trying to factory reset the device over and over, on the fifth attempt the Fire TV will allow you to reset the device without entering a PIN.

This somewhat hidden backdoor to factory reset a PIN protected Fire TV without knowing the PIN has been in place for several years. Even though the device asks for your PIN every time you try to reset it, it eventually accepts the request and displays the final confirmation message needed to factory reset the device, even though a PIN was never entered. While this seems like a bug, my theory is that it is intentionally put in place to give people who purchased a used Fire TV that has parental controls enabled a way to reset the device without knowing the PIN. While having a backdoor method to reset a Fire TV that is PIN protected is certainly handy in certain scenarios, it’s unfortunate for someone relying on parental controls from keeping a curious kid from changing how the device is configured.