v0.1.1-preview.1

Warning

This is an unsigned Windows Preview evaluation release. Windows will display Unknown Publisher. Use it for non-production evaluation while trusted signing remains a GA gate.

The MSI, portable ZIP, package-manager candidates, checksums, SPDX SBOM, and keyless Sigstore bundles were produced by the protected release workflow from this immutable tag.

Vault Prospector 0.1.1-preview.1

0.1.1-preview.1 is the current Windows x64 non-production evaluation release. It replaces the
withdrawn 0.1.0-preview.2 package and includes a corrected transactional upgrade schedule plus
the security, recovery, onboarding, and accessibility hardening completed after Preview.2.

Highlights

• Install with a normal per-machine MSI or use the self-contained portable ZIP.
• Connect multiple Microsoft Entra identities through system-browser public-client authentication;
  Vault Prospector never requests an Entra password or client secret.
• Discover subscriptions and Azure Key Vaults, index secret/key/certificate metadata, and search
  the encrypted local index without retrieving values during synchronization.
• Reveal, copy, or explicitly cache secret values only after Windows Hello verification.
• Keep offline caching disabled by default; when enabled, protect values with AES-GCM and a
  current-user DPAPI-protected key.
• Use favorites, recent-access ordering, identity/workspace scoping, filters, and partial/cancelable
  synchronization.

Security and reliability changes since Preview.2

• Failed MSI upgrades now preserve the exact prior registration, executable, runtime configuration,
  shortcut, and retained user state inside the Windows Installer transaction.
• Existing encrypted databases and cache envelopes never mint replacement keys when their matched
  protected key is missing.
• Future, corrupt, wrong-key, incomplete-schema, and invalid-relationship metadata databases fail
  closed without downgrade, silent rebuilding, or plaintext fallback.
• Offline-cache scope, expiry, fingerprint, item, vault, and workspace descriptors are authenticated
  before decisions; malformed, substituted, or tampered data is rejected.
• Identity persistence failure rolls back a newly authenticated MSAL account; offline opens fail
  closed if their non-sensitive access audit cannot be written.
• Clipboard ownership uses a zeroized digest rather than retaining a second plaintext value, and
  stale clear timers cannot erase a newer clipboard item.
• Error screens provide redacted recovery guidance without echoing exception details.

Accessibility and usability changes

• Window sizing, stacked layouts, scrolling, and text resources keep tasks reachable at 200%
  display scaling and 200% Windows text size.
• High Contrast colors, focus indicators, placeholders, and selector text follow Windows system
  resources.
• Authored controls have explicit UI Automation names; numeric stepper targets meet the 24-pixel
  WCAG 2.2 AA floor.
• NVDA receives tab focus events, complete error/recovery announcements, routine status, browser
  cancellation status, and focus return to the initiating control.

Install and upgrade

1. Download VaultProspector-0.1.1-preview.1-win-x64.msi and its checksum from the public
   release page.
2. Verify SHA-256 using the adjacent .sha256 file.
3. Run the MSI and approve the administrator prompt.
4. Windows displays Unknown Publisher because this Preview is intentionally unsigned. Trusted
   signing remains required before stable/GA promotion.

The MSI version is 0.1.101, which upgrades withdrawn Preview.2 (0.1.2) and the public CI.68 test
build (0.1.68). Do not reuse or resubmit Preview.2. Uninstall retains
%LOCALAPPDATA%\VaultProspector; delete that directory explicitly only when all local state should
be removed.

Known Preview limitations

• Use non-production Azure resources. Independent security assessment and production approval are
  not complete.
• WinGet and Chocolatey entries may lag the direct GitHub release while community validation and
  moderation complete.
• Live coverage across every MFA, Conditional Access, guest, tenant-consent, Windows Hello, and
  assistive-technology configuration is still expanding.
• There is no supported cross-device backup/restore or DPAPI key migration. Reconnect identities
  and resynchronize from Azure on a replacement device.
• Background taskbar operation, browser integration/autofill, write operations, CyberArk, iPhone,
  and Android applications remain roadmap work.
• Project-controlled telemetry is disabled. Preview feedback is voluntary and must not include
  credentials, tokens, secret values, or sensitive identifiers.

Rollback and support

If a blocking defect appears, stop using the build, preserve non-sensitive diagnostics, and report
it through the public feedback route or private security contact as appropriate. The release owner
will withdraw rather than replace immutable assets. To remove the application, uninstall it from
Windows Installed apps; local state remains until explicitly deleted.

See the user guide, Preview scope,
privacy statement, security policy, and
release operations runbook.

Full Changelog: v0.1.0-preview.2...v0.1.1-preview.1

v0.1.0-preview.2

What's Changed

• docs(release): record preview evidence by @kristopherjturner in #4

Full Changelog: v0.1.0-preview.1...v0.1.0-preview.2

v0.1.0-preview.1

What's Changed

• docs(vault-prospector): update product name by @kristopherjturner in #1
• feat(vault-prospector): release Windows preview by @kristopherjturner in #2
• fix(release): handle private attestation limits by @kristopherjturner in #3

New Contributors

• @kristopherjturner made their first contribution in #1

Full Changelog: https://github.com/Hybrid-Solutions-Cloud/vault-prospector/commits/v0.1.0-preview.1