Bootloader (and secure boot)
also: boot loader · secure boot · root of trust
The small program that runs first at power-up, checks and starts the main firmware and handles updates; secure boot adds signature checks.
When a device powers on, the bootloader decides what runs. It can verify that the main firmware is intact, choose between stored firmware copies, fall back to a known-good version, and accept new firmware over USB, serial or a wireless link. Secure boot extends this: firmware images are signed by the manufacturer, and the bootloader refuses to run anything whose signature doesn't verify against a key held in the chip.
The bootloader is usually the hardest part of a product to change after shipping, because a failed bootloader update can permanently brick a device. It deserves more design and testing attention than its size suggests, including how signing keys are generated, stored and, if necessary, rotated.
Cybersecurity guidance and regulation increasingly expect secure, authenticated update mechanisms; secure boot plus signed updates is the usual foundation.
Founder takeaway
Treat the bootloader and signing keys as product-lifetime decisions, and test recovery from an interrupted update before the first unit ships.
engineer review pending