Eight new modules, each with its limit next to the promise

What it reads

Reads the Uninstall registry hives (HKLM and HKCU, 32- and 64-bit), extracts each program's name and version, and compares them against a local catalogue of 14 advisories with “lower than” and range rules. It queries no external service.

The limit

The catalogue is ours and it is small: it covers the applications commonly found on a Romanian machine, not the whole CVE database. An “unknown” result appears when the version cannot be parsed — it is never rounded up to “fine”.

What it reads

Reads the ConsentStore registry keys — camera and microphone access grants, per application — plus the global switch. FILETIME timestamps are converted to dates with guards for impossible values.

The limit

Windows does not write a “last used” stamp on every build. When it is missing we report it as absent rather than inventing a date. The module does not block the camera: it shows you the permissions so you can revoke them yourself in Settings.

What it reads

Runs `netsh advfirewall firewall show rule name=all verbose` and `netsh advfirewall show allprofiles`, then evaluates every active rule: direction, profiles, local and remote address, program and ports.

The limit

The module is strictly read-only: it neither creates nor deletes rules, because a wrong firewall change can cut you off the network. It tells you what needs fixing and you decide.

What it reads

Reads the 8 system mitigations through `Get-ProcessMitigation` and the per-application configuration from the `ExploitGuard` registry XML. An `Override* = false` means “use the default”, not “off”.

The limit

Values Windows does not expose stay “unknown” instead of becoming “pass”. You can apply a baseline for the watched applications, but every change is written to the audit log.

What it reads

A full MIME parser: RFC 2047 encoded headers, multipart parts, quoted-printable and base64, RFC 2231 filenames, SPF/DKIM/DMARC results from `Authentication-Results`, From versus Return-Path mismatch and double extensions. Attachments are extracted to temp, scanned by the file engines, then deleted.

The limit

It does not connect to your mailbox: it scans files, not an IMAP account. The SPF/DKIM/DMARC checks read what the receiving server wrote — if the header is missing, the result is “unknown”, not “authentic”.

What it reads

Enumerates volumes through `Win32_LogicalDisk`, distinguishes removable from fixed by drive type, reads `autorun.inf` (including when `open=` carries arguments) and inspects root files without executing them.

The limit

Without a signed driver we cannot block a device from mounting: we scan what is on it. AutoRun is disabled by default on Windows 10 and 11 anyway — the check still matters where it has been re-enabled.

What it reads

Runs the same primitives as the web engine — confusable character normalisation, Levenshtein distance, URL analysis — plus a bank catalogue and signals for forms asking for national ID, IBAN or CVV.

The limit

HTTPS does not mean “legitimate merchant”, and we do not pretend it does. A correctly spelled domain with a valid certificate passes even if the shop is dishonest — the module reduces risk, it does not remove it.

What it reads

Eight areas — 24 hardening checks, real-time protection, vulnerabilities, exploit mitigations, firewall, privacy, backup and the driver — each weighted. The score is points earned out of points possible, not a cosmetic average.

The limit

An “unknown” or “off” area scores zero, not half, while “attention” scores half. The score can therefore drop when a check cannot be performed — that is the intent.