what's next, honestly dated where we can be

linux checks, all eight

DNS, VPN tunnel, traffic egress, firewall, IPv6 leak guard, MAC randomization, encrypted messaging, disk encryption — all read-only, all at full depth.

broad init/package-manager detection

systemd, OpenRC, runit, s6, dinit, sysvinit; apt, dnf, pacman, emerge, zypper, apk, xbps, nix — detected, never assumed.

revert-all safety script

Generates a commented, reversible shell script for anything veil applied, plus a plain-text how-to.

single static rust binary, no python required

The linux build is a statically-linked Rust binary with zero external crates — no Tauri, no interpreter, nothing to install first. python3 veil.py still runs and stays the reference implementation every Rust check is verified against, but it's no longer what ships.

privileged helper for one-click apply

A small, separately-invoked helper that maps an opaque check id to a concrete fix — the GUI itself never runs elevated, and no user input reaches a shell.

windows support

Every check rebuilt as a native Windows probe. Two are expected to be narrower than linux from day one: MAC randomization (partial — Windows exposes the current MAC and the OS-level random-hardware-addresses toggle, not per-SSID policy) and firewall reads (Windows Defender Firewall profile state; a third-party firewall reads as "applied by something else," not a failure).

always-on guardian + auto-heal

A background monitor that alerts the moment a protection drops and can re-apply it automatically — plus-tier, local only, no hosted service.

posture history + scheduled scans

Track what changed and when, stored locally — no cloud sync, no account required.