Where Hollowpath is, honestly
Hollowpath is built and used hands-on, one milestone at a time. This page reflects actual status, not intent — if something below says “planned,” it isn’t built yet.
- 01Complete
Foundation
The core engine and domain model (Asset, Service, Finding, Evidence, ExploitCandidate), a centralized default-deny scope engine, and the desktop interface — CLI, REPL console, and GUI, all calling the same underlying functions.
- 02In progress
Investigation
The asset-centric investigation navigator, a read-only relationship index over the current run's data, explicit operator-asserted links between related findings, and an analyst's own confirmed / false-positive / accepted-risk assessment of each finding, tracked separately from how it was originally verified.
- 03Planned
Web verification workspace
Deeper, more structured URL and web-service verification workflows, building on the enumeration and confirmation patterns already in place.
- 04Planned
Exploitation awareness
Today, Hollowpath runs one background operation at a time — one thread per long-running action. That's a deliberately simple starting model, not a final one: scope enforcement and the confirmation flow were the priority to get right first. Concurrent operations (multiple exploitation attempts, concurrent scanning) mean redesigning that model directly, which is why it's sequenced as a deliberate milestone rather than an incremental add.
- 05Planned
Review-aware reporting
Findings review (see Investigation, above) doesn't yet reach the generated report — a finding an analyst marked as a false positive currently exports the same as one they confirmed. Closing that gap is what's left.
- 06Direction
Beyond Hollowpath's own tools
Right now, Hollowpath structures the output of tools it runs itself. The longer-term direction is for it to work the same way with results generated elsewhere, so the same relationship model applies across all of it — not just what Hollowpath produced. Nothing here is built yet, and this isn't a scheduled milestone; it's the direction the engine is being built toward.
A note on scope
Features get built when there’s a real, concrete need for them — not because a long-term vision document mentions them. A correlation engine, CVE/CPE intelligence, and persistent engagement history are all explicitly deferred until something in active use actually requires them, rather than being built speculatively ahead of time.
The same principle applies to what’s already shipped: known limitations are documented, not hidden — see the security philosophy page for a specific example.