Firmware Release Gate for sdkconfig and prj.conf

It reads an ESP-IDF sdkconfig, a sdkconfig.defaults or a Zephyr prj.conf and reports the lines that a shipped unit should not carry: secure boot off, flash encryption in Development mode, a secure-boot escape hatch, unsigned MCUboot images, skipped TLS verification, plaintext http:// endpoints and hard-coded credentials. Each finding names the line number and the setting a release build should carry instead.

Embedded firmware engineers who own the release build of an ESP32 or Zephyr product, and the one person on a small hardware team who signs off that a batch may be flashed. If you build with idf.py or west and the config lives in git, this reads the same files your build reads.

A chatbot cannot see your sdkconfig, and pasting a generated config into one gives you advice about symbols that may not exist in your IDF version. The free Kconfig hardening checkers in this space target the Linux kernel, not ESP-IDF or Zephyr and MCUboot, so the symbols that decide whether your device boots unsigned images are not in their rule sets.

Free audits the config file you have open, the whole file, with every finding and its remedy, and it never asks for a key. A licence adds the jobs that start when one file is not enough: auditing every config in the repository, exporting the report file you keep with the release, and a JSON output that fails the build in CI.

An outside firmware-only security review starts around $6,000, and a full IoT device assessment runs roughly $10,000 to $50,000. Those are worth paying for, but not to be told that flash encryption was left in Development mode. This is $29 once, so the review you pay for starts past the config layer.

From 11 September 2026 the EU Cyber Resilience Act requires a manufacturer to report an actively exploited vulnerability in a product with digital elements: an early warning to ENISA and the national CSIRT within 24 hours and a full notification within 72 hours. A unit that boots unsigned images or ships a hard-coded credential is not a bug you patch quietly, and units in the field cannot be re-configured.