Roadmap

Last updated: 2026-07-18

This roadmap outlines shipped, in-development, and planned features for NetVuln Tool and the Bullium Consulting collection portal. Items are prioritized by business impact and implementation feasibility. Portal-side companion work ships in the separate bullium-site repository.

Completed (v2.8.0 through v4.2.4)

Version	Feature	Status
v2.8.0	Risk scoring engine (A-F grades, severity-weighted)	Shipped
v2.8.0	Email security assessment (SPF/DKIM/DMARC)	Shipped
v2.8.0	Remediation tracking (cross-session, first_seen)	Shipped
v2.8.0	Scan diff CLI (terminal/JSON, CI exit codes)	Shipped
v2.8.0	Multi-channel alerts (email, Slack, webhook)	Shipped
v2.9.0	Executive summary generation and upload	Shipped
v2.9.0	Alert results capture in session JSON	Shipped
v2.10.0	Scheduled scan metadata injection, health endpoint, E2E smoke tests	Shipped
v2.11.0	Cross-platform support (macOS + Linux/Debian/Raspberry Pi)	Shipped
v2.12.0	Platform validation (pi_validate.sh), missed-scan detection (schedule_monitor.sh)	Shipped
v2.13.0	Multi-target schedule management (schedule_list.sh, schedule_status.sh)	Shipped
v2.14.0	Report white-labeling and CLIENT_ID multi-tenancy scoping	Shipped
v2.15.0	Executive summary template engine, remediation progress, PDF export	Shipped
v3.0.0	Persistent scheduling daemon with retry, heartbeats, and systemd	Shipped
v3.1.0	Synthetic collection generator, exception/accept-liability workflow, dual scoring model	Shipped
v3.2.0	Compliance mapping (CIS v8, NIST CSF, PCI-DSS v4.0, SOC 2), network topology visualization	Shipped
v3.3.0	Python orchestrator: full CLI, native scoring engine, native HTTP upload + diff, strict mypy	Shipped
v3.4.0	Pipeline plugin hooks, license soft gate, progress callbacks, status --remote, pip console script	Shipped
v3.5.0	Parallel module execution (ThreadPoolExecutor), pre-push test hook split	Shipped
v4.0.0	Automated CI versioning (VERSION file, bump_version.sh, release.yml auto-tag), Python quality CI	Shipped
v4.0.1-v4.0.4	Release-pipeline hardening (workflow_dispatch fallback, heredoc YAML fix, workflow YAML validation)	Shipped
v4.1.0	Unified license model (online validation, cache + grace), ORC 9.64 framework, BATS assertion lint	Shipped
v4.2.0	Containerization: Alpine image published to the Gitea container registry (publish-image.yml)	Shipped
v4.2.1	Container publish hardening (lowercase tags, registry-secret preflight)	Shipped
v4.2.2	Pinned bats runner (v1.13.0) in ci/release to fix flaky heredoc test extraction	Shipped
v4.2.3	Session license metadata + business-tier gating (#46), NV_VERSION from VERSION file (#52)	Shipped
v4.2.4	E2E smoke test share round-trip fix (#62)	Shipped

In development (unreleased)

Work merged to dev and awaiting the next stable tag. See the Changelog for detail.

• WiFi access-point discovery (#71): opt-in standalone Linux-only scanner (discover_wifi.sh), managed-mode nmcli/iw with best-effort --monitor capture. See WiFi Discovery.
• Field-appliance enclosure design (#74): a proprietary Pi 5 plus RTL-SDR 3D-printed case under appliance/ (excluded from the container image; see Open Source Boundary).
• Docker Compose runner (#65): docker compose run --rm scan recon -t <lan>, with privileged scans enabled via nmap file capabilities. See Docker.
• C2 session visibility and on-demand push (#84, #86): run_scan reports its session id and can auto-push results; a new push_session command uploads an existing session on demand; pushed push_config overrides now persist across restart. See Command and Control.

Planned

Portal push notifications

Priority: Medium | Effort: Medium

Server-side notifications from the portal to reduce reliance on users checking the dashboard.

• Email digest: weekly summary of new sessions, risk trends, and expiring reports
• Configurable notification preferences per user
• Webhook integration for external notification systems
• Digest template customization

API v2 / webhook events (Phase 4)

Priority: Low | Effort: Medium

Phases 1 through 3 of the webhook event system have shipped (subscription CRUD, HMAC-SHA256 signing, the scan_completed / status_changed / session_deleted / report_expiring events, and the admin management UI). Phase 4 remains planned:

• Event types: scan_started (scripts-side), finding_new and finding_resolved (cross-session diff)
• Delivery logs and retry history in the portal UI
• Integration guides for SyncroMSP, ConnectWise, and Datto

Contributing to the roadmap

Feature requests and feedback are welcome. File issues on the Gitea repository. When picking up a roadmap item:

1. Create a feature/* branch from dev.
2. Reference the roadmap item in commit messages.
3. Update this file when work begins and when it completes.
4. Follow the cross-project change checklist in the API Contract for portal-touching changes.

See Contributing for the full development workflow.