Roadmap

Last updated: 2026-07-24

This roadmap outlines shipped, in-development, and planned features for NetVuln Tool and the Bullium Consulting collection portal. Items are prioritized by business impact and implementation feasibility. Portal-side companion work ships in the separate netvuln-portal repository.

Completed (v2.8.0 through v4.3.3)

Version	Feature	Status
v2.8.0	Risk scoring engine (A-F grades, severity-weighted)	Shipped
v2.8.0	Email security assessment (SPF/DKIM/DMARC)	Shipped
v2.8.0	Remediation tracking (cross-session, first_seen)	Shipped
v2.8.0	Scan diff CLI (terminal/JSON, CI exit codes)	Shipped
v2.8.0	Multi-channel alerts (email, Slack, webhook)	Shipped
v2.9.0	Executive summary generation and upload	Shipped
v2.9.0	Alert results capture in session JSON	Shipped
v2.10.0	Scheduled scan metadata injection, health endpoint, E2E smoke tests	Shipped
v2.11.0	Cross-platform support (macOS + Linux/Debian/Raspberry Pi)	Shipped
v2.12.0	Platform validation (pi_validate.sh), missed-scan detection (schedule_monitor.sh)	Shipped
v2.13.0	Multi-target schedule management (schedule_list.sh, schedule_status.sh)	Shipped
v2.14.0	Report white-labeling and CLIENT_ID multi-tenancy scoping	Shipped
v2.15.0	Executive summary template engine, remediation progress, PDF export	Shipped
v3.0.0	Persistent scheduling daemon with retry, heartbeats, and systemd	Shipped
v3.1.0	Synthetic collection generator, exception/accept-liability workflow, dual scoring model	Shipped
v3.2.0	Compliance mapping (CIS v8, NIST CSF, PCI-DSS v4.0, SOC 2), network topology visualization	Shipped
v3.3.0	Python orchestrator: full CLI, native scoring engine, native HTTP upload + diff, strict mypy	Shipped
v3.4.0	Pipeline plugin hooks, license soft gate, progress callbacks, status --remote, pip console script	Shipped
v3.5.0	Parallel module execution (ThreadPoolExecutor), pre-push test hook split	Shipped
v4.0.0	Automated CI versioning (VERSION file, bump_version.sh, release.yml auto-tag), Python quality CI	Shipped
v4.0.1-v4.0.4	Release-pipeline hardening (workflow_dispatch fallback, heredoc YAML fix, workflow YAML validation)	Shipped
v4.1.0	Unified license model (online validation, cache + grace), ORC 9.64 framework, BATS assertion lint	Shipped
v4.2.0	Containerization: Alpine image published to a container registry (publish-image.yml)	Shipped
v4.2.1	Container publish hardening (lowercase tags, registry-secret preflight)	Shipped
v4.2.2	Pinned bats runner (v1.13.0) in ci/release to fix flaky heredoc test extraction	Shipped
v4.2.3	Session license metadata + business-tier gating (#46), NV_VERSION from VERSION file (#52)	Shipped
v4.2.4	E2E smoke test share round-trip fix (#62)	Shipped
v4.3.0	End-user installer (install.sh), VitePress docs site, WiFi discovery (#71), appliance design (#74), docker-compose (#65), C2 session push (#84, #86)	Shipped
v4.3.1	Docs site CI auto-deploy; Portal nav link fix (#96)	Shipped
v4.3.2	E2E smoke-test whitespace-strip fix	Shipped
v4.3.3	Docs custom domain + SEO (#101); doc version-drift guard + auto-sync (#102, #104)	Shipped

In development (unreleased)

Work merged to dev and awaiting the next stable tag. There is no unreleased feature work at this time; recent dev activity has been documentation and release-tooling maintenance. See the Changelog for detail.

Planned

Portal push notifications

Priority: Medium | Effort: Medium

Server-side notifications from the portal to reduce reliance on users checking the dashboard.

• Email digest: weekly summary of new sessions, risk trends, and expiring reports
• Configurable notification preferences per user
• Webhook integration for external notification systems
• Digest template customization

API v2 / webhook events (Phase 4)

Priority: Low | Effort: Medium

Phases 1 through 3 of the webhook event system have shipped (subscription CRUD, HMAC-SHA256 signing, the scan_completed / status_changed / session_deleted / report_expiring events, and the admin management UI). Phase 4 remains planned:

• Event types: scan_started (scripts-side), finding_new and finding_resolved (cross-session diff)
• Delivery logs and retry history in the portal UI
• Integration guides for SyncroMSP, ConnectWise, and Datto

Later

Items on the horizon, not yet scheduled:

• Secrets vault migration Phases 2-3: evaluate vault options and migrate the highest-risk secrets, then automatic rotation via vault policies. See Secrets Management.
• Appliance SKU: hardware pricing under evaluation.

Contributing to the roadmap

Feature requests and feedback are welcome. File issues on the repository. When picking up a roadmap item:

1. Create a feature/* branch from dev.
2. Reference the roadmap item in commit messages.
3. Update this file when work begins and when it completes.
4. Follow the cross-project change checklist in the API Contract for portal-touching changes.

See Contributing for the full development workflow.