Software vulnerability tracking for teams
Know what runs.
See what needs
attention.
Keep WordPress plugins and GitHub dependencies in view. Candler checks their exact versions for known security flaws, so your team knows what to review next.
From inventory to action
A shared view of known risk.
Bring your software.
Add WordPress sites and their plugin versions by hand or CSV. Connect selected GitHub repositories to import exact dependency versions from their lockfiles.
Understand the findings.
Review known vulnerabilities from Wordfence and OSV. See which are listed by CISA as actively exploited, alongside source details and reported fixed versions.
Keep your team informed.
Send alerts to email, Slack, or Microsoft Teams. Acknowledge findings, record why you ignore one, and keep a history as software and findings change.
Know what was checked.
Know what was not.
Candler checks known vulnerability records. A clean check means no known match in the checked source. It does not prove your software is safe.
GitHub access is read-only. Candler checks root composer.lock and package-lock.json files without running repository code. Missing versions, failed checks, and gaps in coverage stay visible.
Your software. Your next step.