Should You Periodically Clean or Reset Your Computer? A Security Schedule

Yes to regular cleaning, usually no to resetting on a calendar. Routine cleanup (updates, pruning apps and extensions, rotating tokens) removes real attack surface every week. A full factory reset is the right tool when something happens: a suspected compromise, a sale or handover, a role change, or an operating system that has lost security support.

The exception is a developer workstation, which collects credentials and old toolchains faster than any other device; a planned yearly rebuild from lockfiles is often cheaper than auditing it. Below: a cleanup schedule, what each reset option really does on Windows and macOS, and how to rebuild without restoring the old problems.

Key takeaways

• Cleanup is a security control, not just a speed trick. Every unused app, extension, token and background agent is attack surface you can remove for free.
• The words matter. On Windows, "Reset this PC" with Keep my files removes apps and settings, while Remove everything removes personal files too. On macOS, reinstalling from Recovery keeps your apps and data, while Erase All Content and Settings removes them.
• A reset does not fix compromised cloud accounts, stolen tokens or firmware. Rotate credentials from a clean device as part of any reset.
• Back up data, not state. Restore documents and code; rebuild apps, profiles and dotfiles.
• Windows 10 reached end of support on 14 October 2025. Consumer Extended Security Updates run to 12 October 2027, which is a deadline, not a plan.
• If your laptop is enrolled in device management, ask IT before you wipe it.
• On developer machines, rebuild from lockfiles and a software inventory, then re-check every project.

Does periodic cleanup improve security or only performance?

Both, but the security benefit is the reliable one. Speed gains from "cleaning" are inconsistent. The security gains are structural: fewer things running means fewer things to exploit, patch, or hide credentials in.

Here is what accumulates on a computer used daily for a few years:

• Software you no longer use but still run. Old installers, trial apps, vendor update agents and helper services keep running at login. The ones you forgot are the ones that miss updates.
• Browser extensions. Extensions can read and change the pages you visit if you grant them that access. An extension installed for one task years ago may have changed owners or permissions since.
• Credentials. Personal access tokens, package registry tokens, cloud CLI profiles, SSH keys and saved sessions pile up in dotfiles and keychains. GitHub's documentation notes that it automatically removes personal access tokens unused for a year.
• Runtimes and SDKs. Several versions of Node.js, Python and Java. Old runtimes stop receiving fixes.
• Data you no longer need. Exports, database dumps, customer files and screenshots. Data you do not hold cannot leak.

CISA's #StopRansomware Guide (September 2023 edition) puts it plainly in its prevention checklist: regularly patch and update software and operating systems to the latest available versions. Pruning what you do not use shrinks the list you have to patch.

Cleanup does not undo a compromise. Deleting temporary files or one suspicious app does not prove a machine is clean. That is where a reset starts.

Reset, reinstall, clean install, re-image and cloud download: what the terms mean

These words are used loosely in forums and help desk tickets. The vendors define them precisely, and the differences decide whether your data and any malware survive.

Windows

Microsoft's "Reset your PC" support article describes two choices and two sources.

• Keep my files reinstalls Windows and keeps personal files such as documents and photos, but removes apps and settings. You can choose Restore preinstalled apps to reapply the manufacturer's customizations.
• Remove everything reinstalls Windows and removes personal files, apps and settings. Under this option, Clean data erases files and cleans the drive. It takes longer and makes recovery harder, but Microsoft notes that this erasure does not meet government or industry standards.
• Cloud download fetches a fresh copy of Windows with the latest updates, which is useful if local system files are corrupted.
• Local reinstall uses files already on the PC. It is faster on a slow connection but may not include the latest updates.

On Windows 11 the path is Settings, System, Recovery, Reset PC. On Windows 10 it is Settings, Update and Security, Recovery, then Get started under Reset this PC. You can also start a reset from the Windows Recovery Environment through Troubleshoot. If the drive is encrypted with BitLocker, have the recovery key ready before you start. Microsoft also warns that the screen can stay black for more than 15 minutes and that restarting manually during the reset can make it fail.

The cloud download option arrived with Windows 10 version 2004, the May 2020 Update. Microsoft's "What's new in Windows 10, version 2004" page lists it under Reset this PC, and the Windows 10 lifecycle page dates version 2004 from 27 May 2020.

macOS

Apple separates reinstalling from erasing.

• Reinstall macOS from macOS Recovery replaces the operating system. Apple's "How to reinstall macOS" article states that reinstalling macOS does not remove your apps or personal data. On Apple silicon you start Recovery from the power button; on Intel Macs, Command R installs the current version of the most recently installed macOS, while Option Command R and Shift Option Command R use Internet Recovery to fetch the latest compatible version or the version that shipped with the Mac.
• Erase All Content and Settings removes your data, settings and apps while keeping the currently installed macOS. Apple's "Erase your Mac and reset it to factory settings" article says it requires macOS Monterey 12 or later and a Mac with Apple silicon or the Apple T2 Security Chip. The path is System Settings, General, Transfer or Reset. You enter your login password and your Apple Account password, and the process signs you out of Apple services.

On Apple silicon Macs running macOS 26 or later, Apple adds a step: if the Mac was repaired, or you are not sure, use Repair Assistant to check for an unfinished repair before erasing.

The general terms

"Removes most malware" is a deliberate hedge. Operating system resets do not touch firmware, and they do not touch anything stored in your cloud accounts or synced back down after the reset. A synced folder that contains a malicious file will happily put it back.

When is a full factory reset the right answer, and when is it overkill?

A reset is cheap on a phone and expensive on a tuned workstation. Use it when the event justifies the cost.

Overkill looks like resetting a family laptop every three months "just in case", or resetting instead of patching. Neither touches the accounts that hold most of your data today.

If a compromise involves a work device or customer data, report it before you wipe. Erasing the disk erases the evidence.

A maintenance schedule that actually helps security

Each line works for one person and maps to a team control.

Weekly: updates and restarts

Turn on automatic updates for the OS and browser, and actually restart: many fixes do not apply until you do.

On Windows, winget can show what third party apps have updates available:

# List apps with available updates (Windows Package Manager)
winget upgrade

On macOS:

# List available macOS updates
softwareupdate --list

Monthly: prune apps, extensions and data

Once a month, uninstall anything unused in the last 90 days, review browser extensions (below) and check that your backups actually ran.

Quarterly: credentials and access

Every quarter, revoke credentials you do not need (commands below), remove unknown sessions from your main accounts, and restore one file from backup. CISA's ransomware guide recommends regularly testing the availability and integrity of backups in a disaster recovery scenario. A quarterly single file restore is the smallest version of that test.

What does cleanup look like on a developer machine?

Developer workstations are part of the software supply chain. They hold tokens that can publish packages, push to repositories and deploy to production. They also hold the toolchains that build what you ship. Our developer laptop hygiene checklist for package managers and the quarterly dev laptop tooling review go deeper on each tool. Here is the cleanup pass that matters most.

Stale tokens and credentials

Our guide to which files on a developer laptop hold credentials lists the usual locations:

# Common credential and config files (read only listing)
ls -la ~/.npmrc ~/.pypirc ~/.netrc ~/.docker/config.json \
       ~/.aws/credentials ~/.config/gh/hosts.yml ~/.kube/config 2>/dev/null

# SSH keys present on this machine
ls -la ~/.ssh/

Then revoke at the source, not just on disk. Deleting a token file leaves the token valid on the server.

# npm: list your tokens, then revoke ones you do not recognise or need
npm token list
npm token revoke <token-id>

# GitHub CLI: see which accounts and hosts this machine is logged into
gh auth status

npm's documentation notes that revocation takes effect immediately and that the truncated ID shown by npm token list may not work for revoke; use the full ID from npm token list --json.

For GitHub, review tokens in your account settings. GitHub recommends fine grained tokens, an expiration on every token, and the minimum repositories and permissions a task needs.

Old SDKs and runtimes

List what is installed and compare it with what your projects actually use.

# Version managers, if you use them
nvm ls            # Node.js versions
pyenv versions    # Python versions

# Homebrew packages you installed on purpose (not dependencies)
brew leaves

Remove end of life runtimes that no project pins. A project that still needs one has a finding of its own.

Abandoned projects

Old clones carry old lockfiles, .env files and sometimes credentials. Once a year, list your clones, check each for unpushed work with git status and git log --branches --not --remotes --oneline, push or archive what has value, and delete the rest.

Orphaned containers, images and VMs

Old containers and images keep vulnerable packages around, ready to be started by accident. Look first:

docker system df
docker ps -a --filter "status=exited"
docker images --filter "dangling=true"
docker volume ls

Warning: the next commands delete data. docker volume prune removes volumes, and volumes often hold local databases. Before running anything below, check the listing above, confirm which Docker context you are pointed at with docker context ls, and make sure no volume you need is unused right now.

# Confirm which Docker engine you are about to clean
docker context ls

# Remove stopped containers older than 30 days
docker container prune --filter "until=720h"

# Remove dangling images
docker image prune

# Remove stopped containers, unused networks, dangling images and build cache
docker system prune

Docker's pruning documentation explains the defaults: docker system prune removes stopped containers, unused networks, dangling images and unused build cache, but it does not remove volumes unless you add --volumes, and even then only unused anonymous volumes. Unused named volumes need docker volume prune --all. Leave out -f so each command asks for confirmation.

Do the same for old virtual machines and local clusters.

Global packages

Globally installed packages run with your user's permissions from any directory and are rarely updated.

npm ls -g --depth=0
pip list --user

Remove globals you do not use. Prefer project dependencies with pinned versions, so they live in a lockfile.

Which browser extensions, login items and background agents should you review, and how?

Browser extensions

In Chrome, the Chrome Web Store Help article "Install and manage extensions" describes the flow: open the menu, choose Extensions, then Manage extensions. From there you can turn extensions off or remove them. Under each extension's Details you can change its site access to On select, On specific sites or On all sites, and manage allowed sites under Permissions.

Remove extensions you did not use last month, check each remaining one is still from the developer you installed it from, and restrict site access where all sites is not needed. An extension allowed on all sites can read and change what you see on every page, including signed in sessions, so this review is worth more than most.

Login items and background agents on macOS

Apple's "Change Login Items and Extensions settings on Mac" article gives the path: System Settings, General, Login Items and Extensions. The Open at Login list shows items that start when you log in, with a yellow warning triangle next to items that were moved or deleted. The same pane covers App Background Activity, which lets apps run tasks while they are not open, such as checking for updates or syncing.

For a deeper look from the terminal, list launch agents and daemons:

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

For anything unfamiliar, find which app installed it and remove that app properly.

Startup apps and services on Windows

On Windows 11, Settings, Apps, Startup lists apps that launch at sign in. Task Manager's Startup apps tab shows the same list with a startup impact column. From PowerShell:

# Startup commands registered for this machine and user
Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location, User

How do you back up before a reset so you can actually restore?

A reset is only as safe as the backup in front of it. Two rules make the difference: back up data, not state, and prove the backup can be read before you erase anything.

What to back up

• Documents, photos and other personal files.
• Source code that is not pushed anywhere, including stashes and local branches.
• Notes about your environment: which runtimes and versions you use, which tools you install, which editor extensions you rely on. A text file is fine.
• Encryption recovery keys. Microsoft's reset article specifically tells you to have your BitLocker recovery key ready if the device is encrypted.
• Two factor recovery codes, stored offline, not on the machine you are about to erase.

What not to restore

This is where most rebuilds go wrong. After a reset, people copy their whole home folder back, and with it every token, every startup item and every compromised extension.

If the reset is because of a compromise, add one more rule: restore only data you can inspect, and rotate every credential from a different, trusted device before you sign in on the rebuilt machine.

Prove the backup works

Before erasing, open a few files from the backup on another device. If you use full disk images, mount one. A backup you have not read back is a hope, not a backup.

Step by step: a planned yearly rebuild of a developer laptop

This assumes a machine you administer yourself; for a company laptop, read the managed devices section first.

1. Inventory what you have. Write down runtimes, tools and editor extensions. Export lists rather than relying on memory.

brew bundle dump --file=~/rebuild/Brewfile        # macOS with Homebrew
npm ls -g --depth=0 > ~/rebuild/npm-globals.txt
pip list --user --format=freeze > ~/rebuild/pip-user.txt
code --list-extensions > ~/rebuild/vscode-extensions.txt

On Windows:

winget export -o $HOME\rebuild\winget.json

The point of a rebuild is to reinstall less, so read these lists before replaying them.

2. Push or archive every project. For each repository, confirm there is nothing unpushed. Make sure each has a committed lockfile; without one you will not rebuild the same dependency tree.

3. Record a software inventory for each project. An SBOM taken now is a snapshot of what each project resolved to before the rebuild, so you can compare after. With the Safeguard CLI:

cd ~/code/my-service
safeguard scan --dir .
# Results are written as JSON under ./output

4. Back up data and recovery keys, then test the backup. Follow the backup section above. Confirm your BitLocker recovery key or FileVault recovery key is somewhere other than this laptop.

5. Revoke credentials you will not carry forward. Use npm token list, your code host's token settings and your cloud console. Revoke now, so a lost backup holds no live tokens.

Warning: the next step erases the disk. Confirm that the backup from step 4 opens on another device, that you have your encryption recovery key, and that this is a personally owned machine you are allowed to erase. If you boot from installer media to do a clean install, check the target disk by size and model in the installer before deleting partitions, and disconnect external drives so they cannot be selected by mistake.

6. Reset.

• macOS (Apple silicon or T2, Monterey or later): System Settings, General, Transfer or Reset, Erase All Content and Settings.
• Windows 11: Settings, System, Recovery, Reset PC, Remove everything, Cloud download. Turn on Clean data if the machine is leaving your hands.
• Windows 10: consider whether this is the moment to move to a supported OS (see below) rather than reinstalling Windows 10.

7. Update before you install anything else. Install all operating system updates and restart. Then install your browser and password manager.

8. Reinstall deliberately. Use the step 1 lists as a checklist and install current versions.

9. Create new credentials. Generate new SSH keys, create fine grained, expiring tokens, and log in to CLIs fresh. Keep tokens in the operating system's credential store where the tool supports it.

10. Restore projects from the remote and install from lockfiles. Use the strict install command for each ecosystem so the lockfile is enforced:

npm ci                                        # fails if package.json and lockfile disagree
pip install --require-hashes -r requirements.txt
go mod download && go mod verify
cargo build --locked

11. Re-check every project on the rebuilt machine. Run the same scan you ran in step 3 and compare. If something changed, find out why before you ship anything built on this laptop.

safeguard scan --dir .

If a project must stay on the machine, or the network only allows outbound HTTPS, the Safeguard local runner is a mode of the CLI that runs scan jobs on your own computer and uploads only the results. Our post on how the local runner and offline databases work covers setup and the offline vulnerability database import.

How do OS end of support dates change the decision?

End of support turns the question from "should I reset" into "what do I replace". Microsoft's lifecycle page for Windows 10 Home and Pro says version 22H2 is the final version of Windows 10 and that Windows 10 reached end of support on 14 October 2025. Microsoft's consumer support page says that after that date there are no more security fixes, and that the consumer Extended Security Updates program can keep a Windows 10 device protected until 12 October 2027.

That has three practical consequences:

1. Resetting an unsupported OS buys nothing. A reset Windows 10 machine without ESU is just as unpatched.
2. ESU is a bridge. If you enroll, put the October 2027 date in your calendar now along with a replacement or upgrade plan.
3. Hardware age decides the path. If the hardware can run a supported OS, upgrade first and then do any reset on the supported system. If not, retire it with a proper erase.

The same logic applies to macOS. Apple's reinstall article notes that Internet Recovery on Intel Macs may install the latest macOS compatible with your Mac, which may not be the latest macOS. If your Mac cannot run a version that still receives security updates, a reset will not change that.

How does an MDM or managed device change what you are allowed to wipe?

If your computer is enrolled in a device management service, the organization decides how it is wiped, and wiping it yourself can break things. Microsoft's Intune documentation shows how much control the administrator has. For Windows devices, the Wipe action offers three behaviors: keep the enrollment state and user account while removing policies, wipe and continue even if the device loses power (which overwrites free space and, Microsoft warns, can leave some devices unable to start), or a standard wipe that removes all user data, settings and policies. For Macs, the administrator chooses a fallback "obliteration behavior" if Erase All Content and Settings fails, and older Macs without a T2 chip need a six digit recovery PIN set by IT to reinstall afterwards.

In practice, for anyone with a work device:

• Do not reset a managed laptop on your own. It can break enrollment or trigger compliance alerts.
• Report suspected compromise to IT first. They may want logs or a disk image before anything is erased.
• Offboarding is IT's job, but you can help. Our developer laptop offboarding checklist covers what to hand back and what to revoke.

What should a written device hygiene policy say?

A short written policy makes the schedule stick, for a household or a 20 person company. NIST's guidance supports the two anchors: SP 800 111 (November 2007) covers storage encryption for end user devices, and SP 800 88 Revision 2 (September 2025) covers media sanitization, which is the standard to point to when a device leaves the organization. The NCSC's Device Security Guidance collection gives platform specific configuration advice for Windows, macOS, iOS, Android and ChromeOS.

Here is a template you can adapt.

DEVICE HYGIENE POLICY (v1)   Scope: all work laptops and desktops

1. Updates: OS and browser update automatically; restart weekly.
   Unsupported OS replaced or upgraded within 90 days.
2. Encryption: BitLocker or FileVault on; recovery keys escrowed
   with IT or stored offline.
3. Software: install from publishers or approved package managers;
   prune unused apps and extensions monthly.
4. Credentials: expiring, least privilege tokens; review quarterly;
   no secrets in shell config or project files.
5. Developer machines: committed lockfiles, a current SBOM per
   project, yearly rebuild or rebuild after suspected compromise.
6. Backups: automatic; one restore tested every quarter.
7. Resets: after compromise, change of owner or role, end of OS
   support. Report compromise before wiping. Disposal follows
   NIST SP 800-88 Rev. 2. Managed devices are wiped only by IT.

Keep it to one page so people remember it.

Where Safeguard fits, honestly

Safeguard does not clean computers, reset them, manage devices or detect malware on endpoints. Nothing in this post's schedule depends on it. The fit is narrower and specific to developer machines: a laptop is where dependencies get resolved, and a rebuild is the moment old vulnerable versions quietly come back if you install from memory instead of from lockfiles. Safeguard scans repositories, container images and SBOM files for known vulnerable components (safeguard scan --dir ., --image, --sbom), shows which projects contain a given component and version, and can open fix pull requests when a fixed version exists. The local runner keeps those checks on your own machine when code cannot leave it. That helps you prove a rebuilt workstation builds the same, current dependency tree. It does not tell you whether the laptop itself is clean. If you track tools across many machines, our guide on how to inventory developer tools across laptops and build agents covers the wider problem.

Common mistakes

• Choosing Keep my files after a compromise. It keeps the user profile, which is exactly where a lot of persistence and malicious downloads live. After a compromise, use Remove everything or a clean install.
• Assuming macOS reinstall erases data. Apple says reinstalling macOS does not remove your apps or personal data. Use Erase All Content and Settings when you need a clean slate.
• Wiping before rotating. Tokens and sessions survive a reset because they live on servers. Revoke them from a trusted device first.
• Restoring the whole home folder. It brings back dotfiles with credentials, launch agents and old extensions. Restore data, rebuild state.
• Treating Clean data as certified sanitization. Microsoft states that the Clean data option does not meet government or industry standards. If a device leaves the organization, follow your sanitization policy.
• Resetting a managed laptop yourself. Ask IT.
• Rebuilding without lockfiles. Fresh installs resolve to whatever is newest or whatever your cache held, which may not be what you tested.

FAQ

How often should I factory reset my computer?

There is no fixed interval that improves security for most people. Reset on events: a suspected compromise, a change of owner or role, or an operating system that has lost support. Developer workstations are the exception where a planned yearly rebuild often pays off.

Does resetting a PC remove viruses?

Windows "Remove everything" and macOS Erase All Content and Settings remove malware that lives in the operating system and user space. They do not remove anything in firmware, and they do not clean files that sync back from cloud storage. "Keep my files" keeps personal files, so malware stored in them survives.

What is the difference between Reset this PC and a clean install?

Reset this PC is built into Windows and reinstalls Windows from local files or a cloud download, with options to keep or remove personal files. A clean install boots from installer media and lets you delete partitions and install from scratch. Both remove apps and settings; a clean install gives you more control over disk layout.

Does reinstalling macOS delete my files?

No. Apple's documentation says reinstalling macOS from Recovery does not remove apps or personal data. To erase, use Erase All Content and Settings on a supported Mac or erase the disk in Disk Utility before reinstalling.

Should I still use Windows 10 after October 2025?

Windows 10 reached end of support on 14 October 2025. Without the consumer Extended Security Updates program it receives no security fixes. With ESU, updates run until 12 October 2027. Plan an upgrade or replacement before then.

Can I reset my work laptop myself?

Not without asking IT. Managed devices are wiped through the organization's management tools, which can preserve enrollment, remove company data or fully erase the device. A self reset can break enrollment or trigger automatic re-enrollment.

What should I not restore after a reset?

Do not restore credential files, SSH private keys, package caches, whole browser profiles, old installers, or startup and background items. Restore documents and source code, then reinstall software and create new credentials.

Do computer cleaner apps improve security?

Built in tools already cover updates, app removal, startup items and storage cleanup. Any third party utility with broad system access adds something else to trust and update, so weigh that before installing one.

Fix it without waiting for upstream

A rebuilt laptop pulls every dependency again, from whatever registry and version range each project allows, so device hygiene and software supply chain hygiene meet at the rebuild. The fit here is indirect: none of what follows cleans a computer, but it keeps the dependencies and images you rebuild from current and fixed.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo sets up the local runner on your own machine, approves it with a device code and runs a scan from the terminal. On a freshly rebuilt laptop, this is the step 11 check from the walkthrough: confirm that each project resolves to the same, current dependency tree before you build anything on the new install.

Click through it at your own pace, or open it full screen.

The second demo is a real CLI session. You install the CLI, open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. After a rebuild, the same flow handles anything the re-check turns up, and /permissions sets how much it may do without asking.

Click through it at your own pace, or open it full screen.

To try it on your own projects, download Safeguard at safeguard.sh/download and read the CLI documentation.

Quick check

Sources

• Microsoft Support: Reset your PC
• Microsoft Support: Windows 10 support has ended on October 14, 2025
• Microsoft Lifecycle: Windows 10 Home and Pro
• Microsoft Learn: What's new in Windows 10, version 2004
• Microsoft Learn: Wipe devices with Microsoft Intune
• Apple Support: Erase your Mac and reset it to factory settings
• Apple Support: How to reinstall macOS
• Apple Support: Change Login Items and Extensions settings on Mac
• Chrome Web Store Help: Install and manage extensions
• NCSC: Device Security Guidance
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization
• NIST SP 800-111: Guide to Storage Encryption Technologies for End User Devices
• CISA: #StopRansomware Guide
• Docker Docs: Prune unused Docker objects
• GitHub Docs: Managing your personal access tokens
• npm Docs: npm token

Last reviewed: 23 October 2026.