Vault Prospector 0.1.1-preview.1

0.1.1-preview.1 was the Windows x64 non-production evaluation release that replaced the withdrawn 0.1.0-preview.2 package and includes a corrected transactional upgrade schedule plus the security, recovery, onboarding, and accessibility hardening completed after Preview.2.

Highlights

• Install with a normal per-machine MSI or use the self-contained portable ZIP.
• Connect multiple Microsoft Entra identities through system-browser public-client authentication; Vault Prospector never requests an Entra password or client secret.
• Discover subscriptions and Azure Key Vaults, index secret/key/certificate metadata, and search the encrypted local index without retrieving values during synchronization.
• Reveal, copy, or explicitly cache secret values only after Windows Hello verification.
• Keep offline caching disabled by default; when enabled, protect values with AES-GCM and a current-user DPAPI-protected key.
• Use favorites, recent-access ordering, identity/workspace scoping, filters, and partial/cancelable synchronization.

Security and reliability changes since Preview.2

• Failed MSI upgrades now preserve the exact prior registration, executable, runtime configuration, shortcut, and retained user state inside the Windows Installer transaction.
• Existing encrypted databases and cache envelopes never mint replacement keys when their matched protected key is missing.
• Future, corrupt, wrong-key, incomplete-schema, and invalid-relationship metadata databases fail closed without downgrade, silent rebuilding, or plaintext fallback.
• Offline-cache scope, expiry, fingerprint, item, vault, and workspace descriptors are authenticated before decisions; malformed, substituted, or tampered data is rejected.
• Identity persistence failure rolls back a newly authenticated MSAL account; offline opens fail closed if their non-sensitive access audit cannot be written.
• Clipboard ownership uses a zeroized digest rather than retaining a second plaintext value, and stale clear timers cannot erase a newer clipboard item.
• Error screens provide redacted recovery guidance without echoing exception details.

Accessibility and usability changes

• Window sizing, stacked layouts, scrolling, and text resources keep tasks reachable at 200% display scaling and 200% Windows text size.
• High Contrast colors, focus indicators, placeholders, and selector text follow Windows system resources.
• Authored controls have explicit UI Automation names; numeric stepper targets meet the 24-pixel WCAG 2.2 AA floor.
• NVDA receives tab focus events, complete error/recovery announcements, routine status, browser cancellation status, and focus return to the initiating control.

Install and upgrade

1. Download VaultProspector-0.1.1-preview.1-win-x64.msi and its checksum from the public release page.
2. Verify SHA-256 using the adjacent .sha256 file.
3. Run the MSI and approve the administrator prompt.
4. Windows displays Unknown Publisher because this Preview is intentionally unsigned. Trusted signing remains required before stable/GA promotion.

The MSI version is 0.1.101, which upgrades withdrawn Preview.2 (0.1.2) and the public CI.68 test build (0.1.68). Do not reuse or resubmit Preview.2. Uninstall retains %LOCALAPPDATA%\VaultProspector; delete that directory explicitly only when all local state should be removed.

Known Preview limitations

• Use non-production Azure resources. Independent security assessment and production approval are not complete.
• WinGet and Chocolatey entries may lag the direct GitHub release while community validation and moderation complete.
• Live coverage across every MFA, Conditional Access, guest, tenant-consent, Windows Hello, and assistive-technology configuration is still expanding.
• There is no supported cross-device backup/restore or DPAPI key migration. Reconnect identities and resynchronize from Azure on a replacement device.
• Background taskbar operation, browser integration/autofill, write operations, CyberArk, iPhone, and Android applications remain roadmap work.
• Project-controlled telemetry is disabled. Preview feedback is voluntary and must not include credentials, tokens, secret values, or sensitive identifiers.

Rollback and support

If a blocking defect appears, stop using the build, preserve non-sensitive diagnostics, and report it through the public feedback route or private security contact as appropriate. The release owner will withdraw rather than replace immutable assets. To remove the application, uninstall it from Windows Installed apps; local state remains until explicitly deleted.

See the user guide, Preview scope, privacy statement, security policy, and release operations runbook.