Appearance
Roadmap
Last updated: 2026-09-09
This roadmap outlines shipped, in-development, and planned features for NetVuln Tool and the Bullium Consulting collection portal. Items are prioritized by business impact and implementation feasibility. Portal-side companion work ships in the separate netvuln-portal repository.
Completed (v2.8.0 through v4.20.0)
| Version | Feature | Status |
|---|---|---|
| v2.8.0 | Risk scoring engine (A-F grades, severity-weighted) | Shipped |
| v2.8.0 | Email security assessment (SPF/DKIM/DMARC) | Shipped |
| v2.8.0 | Remediation tracking (cross-session, first_seen) | Shipped |
| v2.8.0 | Scan diff CLI (terminal/JSON, CI exit codes) | Shipped |
| v2.8.0 | Multi-channel alerts (email, Slack, webhook) | Shipped |
| v2.9.0 | Executive summary generation and upload | Shipped |
| v2.9.0 | Alert results capture in session JSON | Shipped |
| v2.10.0 | Scheduled scan metadata injection, health endpoint, E2E smoke tests | Shipped |
| v2.11.0 | Cross-platform support (macOS + Linux/Debian/Raspberry Pi) | Shipped |
| v2.12.0 | Platform validation (pi_validate.sh), missed-scan detection (schedule_monitor.sh) | Shipped |
| v2.13.0 | Multi-target schedule management (schedule_list.sh, schedule_status.sh) | Shipped |
| v2.14.0 | Report white-labeling and CLIENT_ID multi-tenancy scoping | Shipped |
| v2.15.0 | Executive summary template engine, remediation progress, PDF export | Shipped |
| v3.0.0 | Persistent scheduling daemon with retry, heartbeats, and systemd | Shipped |
| v3.1.0 | Synthetic collection generator, exception/accept-liability workflow, dual scoring model | Shipped |
| v3.2.0 | Compliance mapping (CIS v8, NIST CSF, PCI-DSS v4.0, SOC 2), network topology visualization | Shipped |
| v3.3.0 | Python orchestrator: full CLI, native scoring engine, native HTTP upload + diff, strict mypy | Shipped |
| v3.4.0 | Pipeline plugin hooks, license soft gate, progress callbacks, status --remote, pip console script | Shipped |
| v3.5.0 | Parallel module execution (ThreadPoolExecutor), pre-push test hook split | Shipped |
| v4.0.0 | Automated CI versioning (VERSION file, bump_version.sh, release.yml auto-tag), Python quality CI | Shipped |
| v4.0.1-v4.0.4 | Release-pipeline hardening (workflow_dispatch fallback, heredoc YAML fix, workflow YAML validation) | Shipped |
| v4.1.0 | Unified license model (online validation, cache + grace), ORC 9.64 framework, BATS assertion lint | Shipped |
| v4.2.0 | Containerization: Alpine image published to a container registry (publish-image.yml) | Shipped |
| v4.2.1 | Container publish hardening (lowercase tags, registry-secret preflight) | Shipped |
| v4.2.2 | Pinned bats runner (v1.13.0) in ci/release to fix flaky heredoc test extraction | Shipped |
| v4.2.3 | Session license metadata + business-tier gating (#46), NV_VERSION from VERSION file (#52) | Shipped |
| v4.2.4 | E2E smoke test share round-trip fix (#62) | Shipped |
| v4.3.0 | End-user installer (install.sh), VitePress docs site, WiFi discovery (#71), appliance design (#74), docker-compose (#65), C2 session push (#84, #86) | Shipped |
| v4.3.1 | Docs site CI auto-deploy; Portal nav link fix (#96) | Shipped |
| v4.3.2 | E2E smoke-test whitespace-strip fix | Shipped |
| v4.3.3 | Docs custom domain + SEO (#101); doc version-drift guard + auto-sync (#102, #104) | Shipped |
| v4.3.4 | Public docs site sanitized of remaining internal infrastructure references (#109, #110) | Shipped |
| v4.3.5 | Docs deploy build fix; roadmap restructured into Shipped / Next / Later (#115, #116, #114) | Shipped |
| v4.3.6 | Python orchestrator findings and session-permission fixes (#111, #112, #121) | Shipped |
| v4.3.7 | House style checker enforced on published docs (#129, #130) | Shipped |
| v4.3.8 | Dead refresh_reports.sh doc examples repointed at the portal; docs drift guard hardened (#143) | Shipped |
| v4.3.9 | Identity JWT sent in the correct header from netvuln status --remote and api_debug.sh (#147) | Shipped |
| v4.3.10 | Identity JWT header fix extended to the e2e suite and published docs; hardcoded test counts removed (#150, #79) | Shipped |
| v4.4.0 | Portal session-listing client (lib/portal_api.sh) and hardened bulk refresh in refresh_reports.sh (#145) | Shipped |
| v4.4.1 | CI apt-lock race fix; PEP 668 virtualenv install path for install.sh (#168, #171) | Shipped |
| v4.4.2 | Doc test-count guard extended to published site mirrors; colorized CLI output and api_debug.sh status-handling fixes (#179, #174, #173) | Shipped |
| v4.4.3 | Docs site operator runbook; Netlify build-config cleanup (#186, #188) | Shipped |
| v4.4.4 | Banned-author-identity guard (check_git_identity.sh); daemon status-dump reliability fixes (#191, #194) | Shipped |
| v4.4.5 | Unified, stable portal agent id derivation; C2 run_scan "Scanner not found" fix (#193, #199) | Shipped |
| v4.4.6 | Agent id keyed off machine id instead of hostname, fixing churn across restarts (#206) | Shipped |
| v4.5.0 | Full toolchain install by default; rootless privileged nmap scans; ANSI-clean C2 output (#208, #209, #210) | Shipped |
| v4.6.0 | Daemon-uploaded sessions include a generated report; raw-scan capability survives nmap upgrades (#217, #215) | Shipped |
| v4.7.0 | C2 run_scan post-scan modules: compliance, topology, executive summary (#229) | Shipped |
| v4.8.0 | C2 push_session post-scan module regeneration (#239) | Shipped |
| v4.8.1 | C2 command dedup for at-least-once delivery (#243) | Shipped |
| v4.8.2 | C2 commands opened to the business license tier (#246) | Shipped |
| v4.8.3 | License e2e tier-gate assertion fix; documentation sync (#250) | Shipped |
| v4.8.4 | ANSI-clean CLI output in non-interactive contexts; visible OS-detection-skipped warning (#255, #256) | Shipped |
| v4.8.5 | C2 update/restart re-exec the daemon so updated code takes effect immediately (#205) | Shipped |
| v4.8.6 | C2 tag-ref fix; per-command scan timeout; scheduled-upload retry with backoff; clickable Compliance finding IDs; consultation-upsell suppression (#266, #267, #268, #269, #270) | Shipped |
| v4.8.7 | Daemon troubleshooting runbook (#281) | Shipped |
| v4.8.8 | C2 run_scan target-list whitespace fix (#286) | Shipped |
| v4.8.9 | Interrupted or timed-out scans upload a populated summary instead of zeros (#290) | Shipped |
| v4.8.10 | Daemon troubleshooting guidance narrowed to avoid a C2 self-update trap (#294) | Shipped |
| v4.9.0 | Dedicated nvt service account and /opt/netvuln-tool install layout (#297) | Shipped |
| v4.9.1 | All tracked shell scripts committed executable, guarded in CI (#302) | Shipped |
| v4.9.2 | C2 scan-timeout finalize hardening; daemon base-directory fix (#306, #307) | Shipped |
| v4.9.3 | E2E Identity login credential percent-encoding fix (#311) | Shipped |
| v4.10.0 | Community Edition export pipeline to the public GitLab mirror (#315) | Shipped |
| v4.20.0 | Posture-steered demo report pipeline; first Community Edition release (#323, #333, #334) | Shipped |
In development (unreleased)
dev and the latest stable tag (v4.20.0) are in sync, so no feature work is merged and awaiting release. Active hardening and follow-up work is in flight against open issues:
- Community Edition export hardening: non-blocking follow-ups from the initial export pipeline review, covering binary-file handling in the export gate (a future non-text file carrying text would pass the replacement map and leak gate unexamined, #324), further pipeline-robustness fixes (#325), and two open product decisions on the docs site's secrets-management mirror and default outbound mailboxes (#326).
- Report renderer hardening (#328): guard null iterations and unbound arithmetic in the Compliance and Topology sections of the report renderer, so a minimal or hand-built session JSON cannot crash it.
- C2 reliability: the daemon's
updatecommand runs git with no enforced timeout, so a hung fetch or pull can wedge the command loop (#263); the API debug tool'sdownloadsubcommand still authenticates with the license key alone instead of the Identity JWT the endpoint requires (#230). - Demo report pipeline follow-on (#323): the synthetic posture steering, demo report builder, and portal seeding shipped in v4.20.0; a further phase (screenshot capture for the marketing site) remains open.
See the Changelog for what has already shipped.
Planned
Portal push notifications
Priority: Medium | Effort: Medium
Server-side notifications from the portal to reduce reliance on users checking the dashboard.
- Email digest: weekly summary of new sessions, risk trends, and expiring reports
- Configurable notification preferences per user
- Webhook integration for external notification systems
- Digest template customization
API v2 / webhook events (Phase 4)
Priority: Low | Effort: Medium
Phases 1 through 3 of the webhook event system have shipped (subscription CRUD, HMAC-SHA256 signing, the scan_completed / status_changed / session_deleted / report_expiring events, and the admin management UI). Phase 4 remains planned:
- Event types:
scan_started(scripts-side),finding_newandfinding_resolved(cross-session diff) - Delivery logs and retry history in the portal UI
- Integration guides for SyncroMSP, ConnectWise, and Datto
Later
Items on the horizon, not yet scheduled:
- Secrets vault migration Phases 2-3: evaluate vault options and migrate the highest-risk secrets, then automatic rotation via vault policies. See Secrets Management.
- Appliance SKU: hardware pricing under evaluation.
Contributing to the roadmap
Feature requests and feedback are welcome. File issues on the repository. When picking up a roadmap item:
- Create a
feature/*branch fromdev. - Reference the roadmap item in commit messages.
- Update this file when work begins and when it completes.
- Follow the cross-project change checklist in the API Contract for portal-touching changes.
See Contributing for the full development workflow.