20Roadmap
What ships next,
and what never will.
A public roadmap is a promise about direction, not a schedule. The refusal list matters more than the feature list.
updated 2026-10-24
Shipped
9- 27-incident dataset with sources and timelines
- Exposure matcher and risk bands
- Interactive blast-radius graph
- Cascade simulator with scrubber
- Risk-per-minute planner with residual risk
- Certificate trust ledger
- Eight playbooks with commands
- Printable and exportable reports
- Stateless API with zod validation
Next
5- Dataset diffing: what changed between two snapshots
- Per-package patch levels instead of a single auto-update flag
- Saved comparison links that encode a profile in the URL fragment
- Keyboard-first navigation for the atlas table
- Accessibility audit with axe in CI
Later
4- Optional local scanner that never uploads inventory
- Import from package manifests to prefill the stack
- Playbook progress persisted per profile
- Multi-language dataset annotations
Refusals
No account system
A security tool that asks for your email before telling you anything is a lead-generation form. The profile stays in localStorage.
No LLM summarisation
An explanation that changes between runs cannot be audited. The exposure notes are written, reviewed, and versioned.
No live threat feed
A feed adds freshness and removes reproducibility. The dataset is a snapshot with a date, and reports name it.
No scanner that uploads
Inventory is the most sensitive data a security product can hold. Until a scanner can run entirely local, it does not ship.