A quarterly review takes about 45 minutes: list what is installed through each package manager, remove what you do not use, update what you keep after reading what changed, and clear stale credentials. The goal is a laptop where every tool has a known source, a reason to exist, and a recent version.
Why quarterly
Tools accumulate. You install something for one project, it stays for years, and nobody patches it. Three months is short enough that you remember why most things are there, and long enough that updates have piled up. Put it in your calendar, because nobody does this on a whim.
The checklist
1. Inventory (10 minutes)
Run the list command for each ecosystem you use. Our inventory post gives the commands. Save the output to a dated file.
2. Prune (5 minutes)
Delete anything you have not used since the last review. Be ruthless with one-off tools, old runtime versions and abandoned projects. The safest software is software that is not there.
3. Update (15 minutes)
- Homebrew: refresh, read the outdated list, then upgrade. See brew update, outdated and upgrade.
- npm globals: list outdated, review, update. See updating global npm packages.
- Python tools and Windows apps: use the routes in uvx or uv tool install and winget upgrade.
Read before you update. A change of maintainer or an odd jump in version is worth a pause.
4. Editor extensions (5 minutes)
List installed extensions and remove ones you do not use. Check that auto-update behaviour is what you intended, as covered in VS Code extension auto-update delay and pinning.
5. Credentials (5 minutes)
Check the places listed in where CLI tools store credentials. Delete tokens for finished projects and replace long-lived keys with shorter-lived ones where your organisation allows it.
6. Configuration (5 minutes)
Look at the package manager config files and environment variables for surprises. The posts on npm config and pip variables say where to look.
Record the result
Add three lines to a notes file: the date, what you removed, and what you updated. Over a year this becomes useful evidence for your own team, and for a customer who asks how you manage developer devices.
For team leads
Consider running the review as a team ritual, with the same checklist for everyone. It is cheap, it spreads habits, and it surfaces tools nobody knew were in use. Pair it with a laptop standard such as automatic updates on a developer Mac.
Where Safeguard fits
Safeguard's SBOM and dependency scanning covers the projects your team builds, which is a separate question from the tools on a laptop. A free scan of a repository is available at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how monitoring catches change over time. A review routine plays the same role for your laptop.
Quick check
Is quarterly too slow for security fixes?
For urgent news about a tool you use, check immediately. The quarterly review is the baseline, not the only time you look.
What if I find a tool I do not recognise?
Find out how it was installed, check what it can access, and remove it if no one can explain why it is there.
Last reviewed: 19 October 2026.
