____ _ ____ _____ ___ ___ _ _
| __ ) / \ / ___|_ _|_ _/ _ \| \ | |
| _ \ / _ \ \___ \ | | | | | | | \| |
| |_) / ___ \ ___) || | | | |_| | |\ |
|____/_/ \_\____/ |_| |___\___/|_| \_|
Microsoft Defender protects your machine. Bastion watches the gaps. Bastion is not an antivirus. It is an open-source local sensor that runs alongsideDefender and covers the surfaces Defender doesn't show you — its own tamper state, persistence drift, camera and mic access, USB, canaries — with a tamper-evident event history and human-readable receipts for every action.
The names aren't an accident. A bastion is the projecting wall that gives a defenderthe firing angles a flat curtain wall can't. Same fortress, different jobs.
Every release is built from the tagged source on GitHub's runners and ships with SHA-256 sums, an SBOM and a signed build-provenance record. Verify a download with gh attestation verify <file> -R 1800bobrossdotcom-byte/bastion. Installers are not yet Authenticode-signed, so Windows SmartScreen will warn on first run.
Access is donation-based. Enter $0.00 for free — or any amount you wish. Submit and we email your key instantly.
Access is donation-based — enter 0.00 to get your key for free, or any USD amount you wish to pledge. We email your signed key immediately.
bc1qtf6fqllw7dny832ksw67p4a99txgvrct7u9e7d0x70B666c4e3EE5B2C9Ab92925F097330813D1848aAny amount keeps development moving. Paste your email above and submit — your key is emailed regardless.
Keep Defender on. Bastion doesn't replace it or compete with it — it gives you an independent local view and the evidence behind every alert.
| Microsoft Defender | + Bastion |
|---|---|
| Malware prevention and real-time blocking | An independent second view of processes, persistence, DNS and files |
| Its own protection settings | Defender Watchdog: alerts if protection, tamper protection or signatures degrade, or a new exclusion appears |
| Cloud-delivered intelligence | Local-first evidence: nothing leaves the device by default |
| Windows event log entries | A hash-chained event history that shows if it was edited afterwards |
| — | Persistence drift: Run keys, services, scheduled tasks, hosts file, Startup folder |
| — | Camera and microphone access log, per app |
| — | Canary files and registry decoys that alert on any touch |
| — | Operator receipts: what was seen, its SHA-256, what was done, and the audit trail |
Actual screenshots of the desktop app. Two surfaces over the same agent: a calm consumer console for day-to-day, and a terminal-themed operator console for triage and response.
src/app/app/page.tsx
src/app/app/operator/page.tsxBOOT_LINES in dashboard/src/app/app/page.tsx; /api/health in agent/src/api.rscounts{} block in app/page.tsx; data from /api/events and /api/quarantine/listsources = unique(events.source) in app/page.tsx; detectors/ in agent/srcassessRisk() in app/page.tsx; triage table + /api/triage routes in agent/src/{store,api}.rsPOST /api/scan/run in agent/src/api.rsGET /api/perf/audit + POST /api/perf/apply in agent/src/api.rsevents list render in app/page.tsx; rows fetched from GET /api/eventsPOST /api/respond/kill-pid + /api/respond/quarantine + /api/trust/* + /api/why/event/:idGET /api/chain/verify in agent/src/api.rsConnectors API in agent/src/api.rs (connectors_list / sentinel_save / sentinel_pull)Every line below is either shipped today, partially implemented, or on the roadmap. Nothing is marketed that the agent does not actually do.
Bastion is free. If it helps you, BTC or ETH donations keep development moving — any amount is welcome.
bc1qtf6fqllw7dny832ksw67p4a99txgvrct7u9e7d0x70B666c4e3EE5B2C9Ab92925F097330813D1848a%APPDATA%\bastion\bastion\data\token.txt.