Debug ports we found on production aircraft.

JTAG, UART, and a shell. What OEMs leave enabled when the schedule slips.

Every board has debug access during development. The question is whether the decision to remove it was made by an engineer or by nobody.

What we look for

• Populated headers and test pads with recognisable pinouts.
• UART traffic at boot — a console that prints is a console that listens.
• JTAG/SWD availability and whether read-out protection is set.
• Bootloader command interfaces reachable over the same pins.

The counter-argument, answered

Manufacturers tell us physical access is out of scope because the aircraft is in the air. Aircraft come down. They come down in places you do not control, and they are recovered by people you did not sell to. Physical access is the baseline assumption for anything that leaves the ground.