Firmware Release Gate for sdkconfig and prj.conf

Finds the build-config lines that ship an ESP-IDF or Zephyr device with secure boot off, a debug port open, unsigned images or plaintext OTA.

Install free

Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.

VS Code MarketplaceOpen VSX (Cursor, VSCodium)npmMCP server (npx)Docker Hub
ext install ReadyStack.firmware-release-gate
npx @readystack/firmware-release-gate <file>
npx @readystack/firmware-release-gate --mcp

Team? One key for every ReadyStack linter, 5 seats, $149 once

Get the full rule table as a PDF
All 18 rules Firmware Release Gate for sdkconfig and prj.conf checks, each with its source and date, on printable pages you can hand to your team or auditor. We email it now, and once more only if a rule changes. No newsletter.

Get the full version $29

Finds the build-config lines that ship an ESP-IDF or Zephyr device with secure boot off, a debug port open, unsigned images or plaintext OTA.

One payment, one licence key for this tool. The key is shown right after payment.

An outside firmware-only security review starts around $6,000 and a full IoT device assessment runs $10,000 to $50,000; this is the config pass you run before you pay for one.

Buy the full version — $29
ENDEJAESPT

Find a tool

· ReadyStack

Worked example

Real numbers from this tool, line by line.

Five sdkconfig lines that ship an ESP32 device unlocked

Five findings land on the nine-line sdkconfig below - the release configuration of an ESP32-S3 gateway that a hardware team in Germany was three days from flashing into a production batch.

sdkconfig:3   # CONFIG_SECURE_BOOT is not set
              -> secure boot off: the ROM boots any image written to flash
sdkconfig:4   CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT=y
              -> Development mode: still re-flashable, key still readable
sdkconfig:5   CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY=y
              -> certificates unverified: anything on the path terminates the OTA
sdkconfig:6   CONFIG_OTA_UPDATE_URL="http://updates.example.net/fw.bin"
              -> the update is served in the clear
sdkconfig:7   CONFIG_EXAMPLE_WIFI_PASSWORD="factory-default"
              -> the credential ships inside every image, and it is in git

None of those five lines is a bug. Every one of them is a setting someone turned on deliberately, on a Tuesday, to get a board to boot - and then never turned back off. That is the shape of the problem: the config that ships is the config that was convenient during bring-up.

The reason a chatbot does not catch it is simple. It cannot see your sdkconfig. Paste a generated config into one and you get advice about symbols that may not exist in your IDF version. The free Kconfig hardening checkers that do exist target the Linux kernel, so the symbols that decide whether MCUboot accepts an unsigned image - CONFIG_BOOT_SIGNATURE_TYPE_NONE, CONFIG_BOOT_VALIDATE_SLOT0 - are not in their rule sets at all.

The timing is what changed. From 11 September 2026 the EU Cyber Resilience Act requires a manufacturer to report an actively exploited vulnerability in a product with digital elements: an early warning to ENISA and the national CSIRT within 24 hours, a full notification within 72 hours. A device that boots unsigned images is not a bug you patch quietly. It is a clock.

Firmware Release Gate is 18 rules that read ESP-IDF sdkconfig, sdkconfig.defaults and Zephyr prj.conf and name the line and the setting that replaces it. Open a file, run it, read the panel - the whole file, free, offline, no key asked. A licence adds the jobs that begin when one file is not enough: every config in the repository at once, the report file you keep with the release, and a JSON output that fails the build in CI.

Run it on a config you believe is clean. On a locked production build - secure boot on, flash encryption in Release mode, NVS encrypted, https OTA - it returns nothing at all. That is the point of a gate: it has to be able to say yes.

15 seconds — what it actually does

Questions people ask

What does Firmware Release Gate actually check?

It reads an ESP-IDF sdkconfig, a sdkconfig.defaults or a Zephyr prj.conf and reports the lines that a shipped unit should not carry: secure boot off, flash encryption in Development mode, a secure-boot escape hatch, unsigned MCUboot images, skipped TLS verification, plaintext http:// endpoints and hard-coded credentials. Each finding names the line number and the setting a release build should carry instead.

Who is this for?

Embedded firmware engineers who own the release build of an ESP32 or Zephyr product, and the one person on a small hardware team who signs off that a batch may be flashed. If you build with idf.py or west and the config lives in git, this reads the same files your build reads.

Why will a chatbot or a free checker not do this?

A chatbot cannot see your sdkconfig, and pasting a generated config into one gives you advice about symbols that may not exist in your IDF version. The free Kconfig hardening checkers in this space target the Linux kernel, not ESP-IDF or Zephyr and MCUboot, so the symbols that decide whether your device boots unsigned images are not in their rule sets.

What is free and what needs a licence?

Free audits the config file you have open, the whole file, with every finding and its remedy, and it never asks for a key. A licence adds the jobs that start when one file is not enough: auditing every config in the repository, exporting the report file you keep with the release, and a JSON output that fails the build in CI.

What would this cost otherwise?

An outside firmware-only security review starts around $6,000, and a full IoT device assessment runs roughly $10,000 to $50,000. Those are worth paying for, but not to be told that flash encryption was left in Development mode. This is $29 once, so the review you pay for starts past the config layer.

Why does this matter now rather than at the next release?

From 11 September 2026 the EU Cyber Resilience Act requires a manufacturer to report an actively exploited vulnerability in a product with digital elements: an early warning to ENISA and the national CSIRT within 24 hours and a full notification within 72 hours. A unit that boots unsigned images or ships a hard-coded credential is not a bug you patch quietly, and units in the field cannot be re-configured.

Why not just ask ChatGPT or another AI chat?

A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Firmware Release Gate checks the file you open against 18 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.

Ask about this tool

One question, answered by the person who built it. Your email only if you want the answer sent.

Embed this tool on your site (free)

Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.

 All embeddable tools

For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →

Same job, next tool

Free in the browser. The full version is a one-time licence.

EN 18031 / PSTI Device Config Lint$29Ren'Py Release Gate$29pyproject.toml Release Gate (PEP 639)$29Lead Magnet Ebook Template - 20 Fill-In Templates to Build and Ship Your Email$49Webflow Restaurant Template — delivered as self-contained HTML you own: 26 pag$49.NET EOL & CRA Support Window Gate$29