SecureWall v0.1.0 (alpha, unsigned test build)

Alpha, unsigned, source-only. Not production-ready. Do not deploy on a machine you cannot recover.

SecureWall is a default-deny Windows firewall — a GPLv3 fork of TinyWall 3.5.1 (pinned upstream 1df71b1). In Normal mode it blocks non-loopback inbound and outbound traffic by default and prompts, per app, when something is blocked. Enforcement runs in a LocalSystem service via the Windows Filtering Platform.

What's in v0.1.0

• Default-deny (fail-closed) firewall with per-app block prompts.
• Optional, opt-in AI "what is this?" helper on the prompt (bring your own OpenAI-compatible API key; off by default; advisory only — never changes the allow/block decision).

Read before using

• No installer attached. This environment cannot build the MSIs. Build from source with Visual Studio Build Tools (MSBuild) + WiX 3.14; installers are unsigned test artifacts, not signed production packages.
• Not independently verified end-to-end. The privileged install / boot-time-filter / audit-policy / live-network matrix in docs/TESTING.md has not been fully validated. The pure-logic unit tests pass (PromptWall.Core.Tests), but that is not a substitute for real-machine testing.
• Some newer code is uncompiled in CI. Build locally and verify before relying on it.
• Requires an expendable Windows 10/11 VM or spare PC with local console, Administrator, a snapshot/recovery path, and any existing TinyWall removed first.

License / attribution

GPLv3. Original TinyWall © Károly Pados; SecureWall modifications © 2026 contributors. Not endorsed by TinyWall's author.