Breachwright 2.4.1

Breachwright 2.4.1

Breachwright 2.4.1 is a Windows packaging hotfix. Advent Cybersecurity created
Breachwright and releases the complete application as open-source software for
the security community. Windows and Linux packages continue to contain the
same feature set, with no accounts, activation, paid editions, seat limits, or
feature gates.

Windows startup fix

• Added .NET runtime configuration beside both Windows executables so the
  bundled Python.NET and WebView2 components load when Windows propagates
  internet-zone metadata from the downloaded ZIP to DLLs.
• Fixed the first-launch failure that reported an inability to resolve
  Python.Runtime.Loader.Initialize from Python.Runtime.dll.
• The fix preserves Windows download-origin metadata. It does not silently
  remove the Mark of the Web from bundled files.

Stronger release validation

• The packaged desktop test now requires the application window to be shown,
  not only the local backend health endpoint to respond.
• The Windows candidate workflow applies internet-zone metadata to the
  packaged Python.NET DLL and verifies that the desktop still opens.
• Windows and Linux native package, installation, upgrade, and archive gates
  remain required before publication.

Downloads

• breachwright-2.4.1-windows-x64.zip
• breachwright-2.4.1-linux-x64.tar.gz
• SHA256SUMS.txt

Verify the published SHA-256 checksum before installation. The Windows
executables are not currently Authenticode-signed, so Windows may show an
unknown-publisher or Microsoft Defender SmartScreen warning. Download only
from the official Advent Cybersecurity GitHub release and do not run files if
their checksums differ from SHA256SUMS.txt.

Back up the workspace from Settings > Data Safety before upgrading. This
hotfix adds no database migration and does not change saved assessment data or
provider configuration. AI remains optional, and using a commercial provider
can incur charges from that provider.

Breachwright 2.4.0

Breachwright 2.4.0

Breachwright 2.4 modernizes optional AI provider setup and compatibility while
preserving the complete local assessment workspace introduced in 2.3. Advent
Cybersecurity created Breachwright and releases the complete application as
open-source software for the security community. Windows and Linux packages
contain the same feature set, with no accounts, activation, paid editions,
seat limits, or feature gates.

Easier hosted-provider setup

• Anthropic and OpenAI setup is now API-key-first. Breachwright selects its
  tested recommendation automatically and shows the exact selection in
  Settings.
• An Advanced section retains an exact model override for operators who need a
  different provider model.
• Existing default Claude Sonnet 4 and GPT-4o settings migrate to the current
  recommendation. Explicit custom model choices remain unchanged.
• OpenAI GPT-5-family models use the Responses API, while explicit legacy
  model overrides retain Chat Completions compatibility.
• Claude 5 requests avoid sampling controls that conflict with the provider's
  adaptive-thinking behavior. Explicit older Claude model overrides retain
  their prior sampling behavior.

Azure, Bedrock, and local providers

• Azure OpenAI uses the stable v1 API by default. Explicit dated API versions
  remain supported for existing deployments.
• Amazon Bedrock requires an explicit model or inference-profile identifier
  because availability differs by AWS region.
• Local OpenAI-compatible providers require an installed model selection
  instead of assuming that a particular model exists.
• OpenAI and Anthropic client libraries are updated for these provider paths.

Maintenance and release safety

• Frontend build tooling received compatible Autoprefixer and PostCSS updates.
• Application server launch paths no longer initialize an unused WebSocket
  protocol implementation.
• Repository documentation and historical release records are easier to find.
• Dependency updates are grouped by ecosystem and compatibility risk.
• Native candidate packaging remains a manual release action. Windows and
  Linux candidates must both pass before public downloads change.
• The upgrade gate now verifies legacy engagement data, finding data, local
  reporting, removed authentication routes, and saved provider configuration.
• AI remains optional. Core assessment, evidence, reporting, export, backup,
  restore, and scanner-correlation workflows do not require a provider.

Downloads

• breachwright-2.4.0-windows-x64.zip
• breachwright-2.4.0-linux-x64.tar.gz
• SHA256SUMS.txt

Verify the published SHA-256 checksum before installation. macOS remains a
source installation until it has the same repeatable native build, desktop,
installation, and signing gates.

The Windows executables are not currently Authenticode-signed. Windows may
show an unknown-publisher or Microsoft Defender SmartScreen warning. Download
only from the official Advent Cybersecurity GitHub release and do not run the
files if their SHA-256 values differ from SHA256SUMS.txt.

Back up the workspace from Settings > Data Safety before upgrading. The
2.4 release adds no database migration. Existing workspaces retain their local
data and saved provider configuration. Read INSTALL.md,
docs/DATA_SAFETY.md, and SECURITY.md for platform paths, restore
procedures, and the single-owner local security model.

Using a commercial AI provider can incur charges from that provider. The
Breachwright application, its complete feature set, and its local workflows
remain free and open source.

Breachwright 2.3.0

Breachwright 2.3.0

Breachwright 2.3 expands the local workspace for active penetration testing.
Advent Cybersecurity created Breachwright and releases the complete application
as open-source software for the security community. Windows and Linux packages
contain the same feature set, with no accounts, activation, paid editions, seat
limits, or feature gates.

Active assessment workspace

• A refreshable engagement Overview brings together findings, asset coverage,
  retest priorities, methodology progress, evidence, readiness, and recent
  local activity.
• Local search spans findings, checklist items, assets, evidence metadata,
  notebook notes, attachments, and exploitation chains.
• Scan snapshots now provide an asset and service inventory with aliases,
  operating-system details, linked evidence, and deterministic new,
  persistent, resolved, and regressed states.
• Retest views distinguish overdue, scheduled, recently remediated, and due
  work without changing deterministic risk-first ordering.

Evidence, scanners, and reusable work

• The Evidence Notebook preserves bounded analyst notes and validated
  attachments before they are ready to become findings.
• Scanner observations and reviewed notebook notes can become findings without
  an AI provider while retaining provenance.
• Nmap and Nuclei Tool Runner results can be copied into Scans, and finished
  tool output can be preserved in the Evidence Notebook.
• Scan upload supports conservative local detection for Nmap, Nessus, Burp
  Suite, Nuclei JSONL, and SARIF, with raw fallback and manual override.
• User-created assessment and finding templates support strict versioned local
  import and export.
• Findings CSV output is spreadsheet-safe and redacted by default. SARIF can
  also be redacted before export.

AI privacy and reliability

• AI actions show the selected provider, local redaction state, input size,
  readiness, and potential external-provider cost before use.
• Scanner, Assistant, report, coverage, narrative, exploitation-chain, Active
  Directory, and Tool Runner context is explicitly bounded before provider
  initialization.
• Assistant answers retain only citations present in the final bounded prompt.
• Provider failures return a safe local message without copying raw provider
  response text into the interface or logs.
• Core findings, evidence, reporting, export, backup, and scanner-correlation
  workflows remain available without an AI provider.

Safety and operations

• Verified backups include Evidence Notebook attachments and can be validated
  from the packaged CLI without changing local data.
• Settings keeps damaged backups visible, reports stored-file integrity and
  backup freshness, and can download a privacy-bounded support snapshot.
• Stored report, attachment, and scan deletion preserves the database record
  when the underlying file cannot be removed, allowing a retry.
• Tool Runner presets are reconstructed from validated server inputs and reject
  shell-control injection. Custom mode launches only the selected supported
  tool directly, without a command shell, and requires confirmation.
• App-owned file paths canonicalize record UUIDs and remain contained beneath
  the configured data directory. Operational logs omit user-controlled paths
  and labels.
• Packaged Tool Runner processes start independently from Breachwright's
  PyInstaller runtime so third-party scanner startup remains isolated.
• Credential redaction handles headers and private-key blocks without
  backtracking-prone searches over assessment data.
• Active Directory imports use bounded ZIP reads, deterministic dataset
  selection, indexed relationship summaries, and explicit cascade-deletion
  confirmation.
• The local API accepts only loopback Host headers. The launcher reports an
  occupied or invalid port immediately instead of opening another local
  service.
• Source builds require Node.js 20 or newer, and the Linux source installer
  uses the committed npm lockfile.

Downloads

• breachwright-2.3.0-windows-x64.zip
• breachwright-2.3.0-linux-x64.tar.gz
• SHA256SUMS.txt

Verify the published SHA-256 checksum before installation. macOS remains a
source installation until it has the same repeatable native build, desktop,
installation, and signing gates.

The Windows executables are not currently Authenticode-signed. Windows may
show an unknown-publisher or Microsoft Defender SmartScreen warning. Download
only from the official Advent Cybersecurity GitHub release and do not run the
files if their SHA-256 values differ from SHA256SUMS.txt.

Back up the workspace from Settings > Data Safety before upgrading. Read
INSTALL.md, docs/DATA_SAFETY.md, and SECURITY.md for platform paths,
restore procedures, and the single-owner local security model.

Breachwright v2.2.0 - Repeatable Assessments

Breachwright 2.2.0

Breachwright 2.2 turns the local assessment workspace into a repeatable retest
workflow. Advent Cybersecurity created Breachwright and provides the official
repository as a fully open-source project. The Windows and Linux packages
contain the same complete feature set, with no accounts, activation, paid
tiers, seat limits, or feature gates.

Repeatable assessments

• Create immutable snapshots from explicitly selected Nmap, Nessus, Burp
  Suite, Nuclei JSONL, or SARIF uploads.
• Compare each snapshot with its prior baseline as new, persistent, resolved,
  or regressed observations.
• Keep an immutable history of finding changes and schedule findings for
  retest.
• Start web, API, network, Active Directory, or cloud assessments from built-in
  templates with automatic methodology checklists.
• Use the current OWASP Top 10:2025 categories for web assessments.
• Review report-readiness blockers and warnings before creating a deliverable.
• Use a dedicated OWASP API Security Top 10 (2023) checklist for API work.

The OWASP Top 10 checklists are baselines and do not represent complete
penetration-test coverage. Use the verification standard and methodology that
fit the assessment scope.

Project portability

Engagement JSON format 1.1 carries editable project records between
installations. It preserves engagement state, checklist progress, findings,
finding history, retest metadata, normalized snapshot history, reviewed AI
provenance, attack paths, MITRE ATT&CK mappings, and saved narrative content.
References to findings are remapped to the newly imported local records.

Portable JSON is intentionally not a full backup. Raw scan files, binary
evidence, Active Directory datasets, pending AI proposals, generated reports,
and Tool Runner output remain in the verified full-workspace backup.

Reporting

• Markdown and DOCX reports remain available without an AI provider.
• Findings and attack paths use deterministic risk-first ordering.
• Valid CVSS zero scores remain visible in Word reports.
• Reviewed attack narratives and MITRE ATT&CK mappings appear once in each
  report.
• Optional AI report enhancement remains an explicit user choice and is
  checked for required findings and evidence references.
• Oversized report, attack-path, narrative, methodology, and Active Directory
  AI context is rejected before any provider request, while local workflows
  remain available.

Safety and compatibility

• Malformed, unsupported, or oversized project imports fail without leaving a
  partial imported engagement.
• Parser values, nested SARIF data, comparison details, uploads, and generated
  records are bounded.
• Mixed or outdated snapshot parser versions produce visible advisory warnings.
• A copied Breachwright 2.0 database is upgraded and tested as part of each
  Windows and Linux candidate build.
• Windows and Linux archives must pass source, packaged, desktop, installer,
  backup, restore, data-preservation, and archive-integrity checks before a
  release is published.

Downloads

The planned native archives are:

• breachwright-2.2.0-windows-x64.zip
• breachwright-2.2.0-linux-x64.tar.gz

Verify each published SHA-256 checksum before installing. macOS remains a
source installation because it does not yet have the same repeatable native
build and desktop test gate.

Cost and privacy

Core workflows are local and require no Advent-hosted infrastructure. Release
tests use standard GitHub-hosted runners, retain no candidate artifacts, and do
not call paid AI models. Optional external AI providers can charge for user
initiated requests. Local compatible model servers remain supported.

Back up the workspace from Settings > Data Safety before upgrading. Read
INSTALL.md and docs/DATA_SAFETY.md for platform paths and offline restore
instructions.

Breachwright v2.0.0 - Open Source Release

Breachwright 2.0.0

Breachwright was created by Advent Cybersecurity and is now fully open source
for the security community under the Apache License 2.0.

One complete distribution

Version 2.0.0 removes product editions, activation keys, subscription checks,
seat limits, engagement limits, finding limits, and feature gates. Every
Breachwright product feature is included in the open-source distribution.

Included capabilities cover:

• Engagement, finding, evidence, retest, checklist, and report management
• AI-assisted scan analysis, attack paths, narratives, and remediation guidance
• SharpHound and BloodHound analysis
• Markdown and DOCX reporting
• Tool Runner workflows
• Engagement export and import
• Custom prompts and report templates
• Cross-engagement knowledge and methodology gap analysis

AI providers

AI-assisted workflows can use Anthropic, OpenAI, Azure OpenAI, AWS Bedrock, or
local and self-hosted OpenAI-compatible endpoints such as Ollama and vLLM.

The former Moxie provider is not included because it depended on a private
Advent-operated service. No open-source workflow depends on Advent-hosted
infrastructure.

Security and maintenance

• Evidence and report files now require authenticated downloads.
• Access tokens are no longer placed in download URLs.
• Vulnerable Python authentication and framework dependencies were replaced or
  upgraded.
• CI, dependency audits, CodeQL, Dependabot, and open-source invariant tests
  are included.
• Community security reporting and disclosure guidance is available in
  SECURITY.md.

Installation

git clone https://github.com/Advent-Cybersecurity/breachwright.git
cd breachwright
python -m pip install -r backend/requirements.txt
cd frontend
npm ci
npm run build
cd ..
python run.py

Docker deployment instructions and AI provider configuration are documented in
the repository README.

Release artifacts

This initial public release is source-only. GitHub provides automatic source
archives for the tag. Windows and Linux binary packages will be added only
after platform-specific packaging and smoke tests pass. Legacy licensed binaries
are not part of this release.