PRODUCT & ENGINEERING ROADMAP
Version Releases & Technical Audit
A code-grounded roadmap prioritizing security, browser fundamentals, and local knowledge capture before autonomous agency.
Code-Grounded Audit & High-Priority Issues
The following priority engine, IPC security, and data protection findings have been identified for resolution across early 1.x releases:
| Finding | Impact | Version |
|---|---|---|
Automatic website permission approval with callback(true) |
Permissions requested without explicit user consent | v1.0.2 |
| Password encryption fallback to plain Base64 | Credentials vulnerable if OS encryption unavailable | v1.0.2 |
| Credential domain matching uses substring comparison | Potential credential exposure on deceptive domains | v1.0.2 |
| Decrypted passwords exposed in renderer & Zustand state | Enlarges credential exposure surface area | v1.0.3 |
| Password interception relies on injected JS & console hooks | Fragile on complex logins & paths | v1.0.3 |
Main application window configured with sandbox: false |
Weakens Electron process isolation boundaries | v1.0.3 |
| IPC handlers lack caller frame & schema validation | Compromised renderer could invoke privileged operations | v1.0.3 |
| New-window requests load inside current web view | OAuth popups & payment flows behave incorrectly | v1.1.0 |
| Workspaces share default Electron session partition | Storage separated, but cookies & auth sessions shared | v1.1.0 |
| Database lacks schema migration / versioning mechanism | Profile updates risk corrupting existing storage | v1.1.0 |
Strategic Release Plan & Feature Tracking Matrix
Our phased rollout strategy separates browser engine stabilization (1.x) from advanced personal knowledge graph capabilities (2.x).
Feature & Security Tracking Matrix
| Feature / Audit Requirement | Target | Status | Date | Commit | Implementation Notes |
|---|---|---|---|---|---|
| Per-Site Permission Prompts | v1.0.2 | ✔ Completed | 2026-07-26 | 107f025 |
Interactive permission prompts & per-origin memory |
| OS-Only Password Encryption | v1.0.2 | ✔ Completed | 2026-07-26 | 107f025 |
Enforced Electron safeStorage & KeyStore |
| Exact Hostname Domain Matching | v1.0.2 | ✔ Completed | 2026-07-26 | 107f025 |
Prevents credential proposals on deceptive domains |
| IPC Sender Frame Validation | v1.0.2 | ✔ Completed | 2026-07-26 | 107f025 |
Validates main application window sender frame |
| Download Collision & Resume | v1.0.2 | ✔ Completed | 2026-07-26 | 107f025 |
Collision-safe file naming & byte offset tracking |
| Database Auto-Backup Snapshot | v1.0.2 | ✔ Completed | 2026-07-26 | 107f025 |
Timestamped snapshot before profile reset |
| Windows Default Browser & Files | v1.0.2 | ✔ Completed | 2026-07-26 | 107f025 |
Default app registration & web file associations |
| Android Mobile Parity & Gradle Fixes | v1.0.2 | ✔ Completed | 2026-07-27 | 96e1125 |
Android intents, deep links & Gradle sync fixes |
| Website Old Versions Archive | v1.0.2 | ✔ Completed | 2026-07-26 | 107f025 |
Historical version downloads & packaging scripts |
| Session Partition Workspace Isolation | v1.1.0 | ✔ Completed | 2026-08-07 | v1.1.0 |
Partition-bound cookies, storage & workspace isolation |
| OAuth Popup Window Manager | v1.1.0 | ✔ Completed | 2026-08-07 | v1.1.0 |
Controlled child popups for Google, GitHub, Microsoft auth |
| Site Security Panel & SSL Inspector | v1.1.0 | ✔ Completed | 2026-08-07 | v1.1.0 |
HTTPS lock icon drawer, SSL details, site permissions |
| Page Controls Suite & Closed Tab Recovery | v1.1.0 | ✔ Completed | 2026-08-07 | v1.1.0 |
In-page search (Ctrl+F), zoom, print, reopen closed tabs |
| Search Engines & Default Browser Sync | v1.1.0 | ✔ Completed | 2026-08-07 | v1.1.0 |
Brave, Ecosia, Kagi, Custom URLs & Windows default browser |
| Encrypted Profile Import/Export Package | v1.1.0 | ✔ Completed | 2026-08-07 | v1.1.0 |
Differentiated Import/Export view & .noemaprofile backups |
Release Schedule Overview
| Version | Focus | Main Deliverables |
|---|---|---|
| v1.0.2 | Security & Parity Release | Per-site permission prompts, OS-only password encryption, exact domain matching, IPC validation, download collision fixes, default browser registration, and Android parity. |
| v1.0.3 | Browser Hardening | Main renderer sandboxing, CSP policies, main-process credential vaulting, system auth locking (Windows Hello), protocol restrictions, and structured diagnostics. |
| v1.1.0 | Browser Fundamentals | Session partition workspace isolation, OAuth popups, site info panel, find-in-page, PDF export, search engine configs, and crash recovery. |
| v1.2.0 | Tab & Workspace Focus | Tab groups, sleeping tabs with memory management, tab search, command palette, workspace templates, and visual workspace overview. |
| v1.3.0 | Knowledge Capture | Webpage text highlighting, passage clipping, page notes, tags, collections, cross-library search, and Markdown export. |
| v1.4.0 | Privacy & Trust | Tracker blocking, per-workspace storage rules, HTTPS-only mode, privacy dashboard, and encrypted local profile backup. |
| v1.5.0 | Local Knowledge Search | Local full-text indexing, local embedding semantic search, source-linked "Ask this page", and local model memory controls. |
| v1.6.0 | Research Assistant | Split-view page comparison, entity/claim extraction, structured research briefs, citation-linked answers, and source monitoring. |
| v1.7.0 | Public Beta Readiness | Signed installers, automatic updates, release channels (Stable/Beta), accessibility audit, and performance profiling. |
| v2.0 | Personal Knowledge Graph | Local graph connecting pages, highlights, notes, topics, and sessions; visual relationship exploration and contextual recall. |
| v2.1 | Active Research Workspaces | Persistent research goals, automated source clustering, evidence timelines, claim-to-source traceability, and research briefs. |
| v2.2 | Controlled Agentic Browsing | Bounded agents monitoring selected sources, scheduling revisits, preparing digests, and requiring confirmation for actions. |
| v2.3 | Collaboration & Sync | End-to-end encrypted sync, self-hosted option, shared research collections, team knowledge graphs, and selective local workspace lock. |
| v2.4 | Noema Platform | Plugin SDK, local AI provider interface, file/calendar connectors, custom workspace widgets, and workflow APIs. |
Product Positioning & Progression
Noema prioritizes browser reliability, security, and knowledge capture over premature autonomous agents:
Security → Browser Completeness → Knowledge Capture → Local Search → Research Intelligence → Controlled Agency
- Noema 1.x: A private, rock-solid, knowledge-oriented desktop browser.
- Noema 2.x: A trusted, local-first environment that actively supports research.