Project Roadmap
Relevant source files
The following files were used as context for generating this wiki page:The Quant project roadmap outlines the planned features and future enhancements designed to make the vulnerability assessment process more powerful, collaborative, and user-friendly. The roadmap is divided into near-term planned features and long-term future enhancements, reflecting a commitment to continuous improvement. Community feedback is encouraged to help shape the project's direction.
Sources: README.md:90-93
Planned Features
These are features actively planned for upcoming releases. They focus on improving user onboarding and configuration.
Sources: README.md:95-99
Interactive Calculator Tours
To improve the onboarding experience for new users, guided interactive tours will be implemented. These tours will walk users through the main interface elements and features of the CVSS calculator.
- Objective: Help new users understand the interface, metric groups (Base, Temporal, Environmental), and advanced features like score contribution analysis.
- Technology: The plan is to use an
onboarding-tourlibrary. - Affected Components: The tour will primarily interact with the
CVSSGenericCalculatorcomponent and its sub-components like theSettingsMenuandScoreCard.
The diagram below illustrates the user flow for an interactive tour.
Advanced Settings Page
A centralized settings page will be created to provide users with comprehensive configuration options. This will consolidate existing settings and add new ones, such as data import/export for the score history.
- Objective: Offer a single location for all application settings and data management.
- Current State: Settings are currently managed within individual components, such as the
SettingsMenuinCVSSGenericCalculator.tsxand import/export functions inScoreHistory.tsx. - Planned Features:
- Centralized UI theme controls (Light/Dark mode).
- Configuration for default calculator views.
- Data management for the Score Manager, including JSON import/export.
The table below summarizes the planned features for the settings page.
| Feature | Description | Related Component(s) |
|---|---|---|
| Data Management | Import and export the entire score history as a JSON file. | ScoreHistory.tsx |
| UI Configuration | Centralized control for theme, alternative descriptions, and score contributions. | CVSSGenericCalculator.tsx |
| Default States | Set default CVSS version and metric values for new calculations. | CVSSGenericCalculator.tsx |
Sources: README.md:98-99, src/components/ScoreHistory.tsx:501-570, src/components/CVSSGenericCalculator.tsx:413-420
Future Enhancements
These are longer-term goals that will significantly expand Quant's capabilities, moving it from a client-side tool to a collaborative platform with automation potential.
Sources: README.md:101-107
Team Collaboration
This enhancement will introduce multi-user support for sharing assessments and enabling collaborative scoring workflows. This represents a major architectural shift from the current client-side, localStorage-based approach.
- Objective: Allow teams to share, review, and manage vulnerability assessments in a shared workspace.
- Architectural Impact: Requires a backend service and database to manage users, teams, and shared score data, moving beyond the current privacy model of 100% client-side processing.
- Affected Components: The
ScoreManager(ScoreHistory.tsx) would be fundamentally changed to sync with a remote server instead of relying solely onlocalStorage.
This sequence diagram shows the proposed flow for a collaborative scoring session.
API Integration
A RESTful API will be developed to allow for automated CVSS scoring. This will enable integration with CI/CD pipelines, external security tools, and other automated workflows.
- Objective: Expose the core scoring logic as a service for programmatic use.
- Core Logic: The API would wrap the pure JavaScript scoring functions found in
src/lib/cvss/v4/scoring.tsandsrc/lib/cvss/v3/scoring.ts. - Potential Endpoints:
POST /api/v4/score: Accepts CVSSv4 metrics and returns a full score object.POST /api/v3.1/score: Accepts CVSSv3.1 metrics and returns a score.GET /api/score?vector={vectorString}: Parses a vector string and returns the score.
The diagram below shows the data flow for an API request.
Vulnerability Database Integration
This enhancement aims to connect Quant directly with CVE databases (like NVD). This would allow for automatic fetching and pre-filling of CVSS scores for known vulnerabilities.
- Objective: Streamline the assessment process by automatically populating scores for known CVEs.
- User Flow: A user could enter a CVE identifier, and Quant would query an external database, retrieve the CVSS vector, and populate the calculator.
- Integration Point: This would add a new input field to the
CVSSGenericCalculator.tsxcomponent to accept a CVE ID.
Sources: README.md:106-107, src/components/CVSSGenericCalculator.tsx
Contributing to the Roadmap
The project actively welcomes community feedback and contributions to the roadmap. Developers and users can participate by opening issues on GitHub to discuss ideas or by joining the community Discord server.
Sources: README.md:109-116