# Know where each finding comes from.

Source: https://candler.app/data-sources

Candler brings source records into a team review workflow. The original providers retain their notices and terms. This page explains the sources; the notices supplied with each record appear alongside that record and in finding alerts.

## Wordfence Intelligence

WordPress vulnerability checks use the Wordfence Intelligence V3 production feed. Wordfence documents free personal and commercial use subject to its terms. Access requires an account and a private API key.

Candler preserves the copyright designations and full license text supplied in each record, including Defiant and MITRE notices when present. Finding details and finding alerts include these notices and a link to the original Wordfence record. A missing notice is shown as missing, not replaced with an invented license.


## OSV and its original sources

Supported package versions are checked through OSV, an aggregator of vulnerability databases using the OpenSSF vulnerability format. Each finding retains its source identifier and links to its OSV record and available references.

Source datasets may have their own terms. Candler does not claim that all OSV records share one license. Any copyright and license notices supplied in the imported record are kept with it. Follow the original record and its references when reviewing reuse terms.


## CISA Known Exploited Vulnerabilities

Candler uses the CISA Known Exploited Vulnerabilities catalog to flag matched identifiers that CISA lists as known exploited. Finding details show linked catalog entries when available.

A KEV flag adds known-exploitation context. It does not prove that a particular site has been attacked, and the absence of a KEV flag does not prove safety.


## GitHub Dependabot preview

With owner-approved read access, the optional preview imports reports from selected repositories. Original identifiers, GitHub state, manifest evidence, timestamps, and source links stay with each report. Sensitive stored evidence is encrypted.

These reports are separate from local exact-version checks and finding decisions. Comparison links do not merge source records. The preview sends no alerts. Follow original source records and provider terms when reviewing the data.


## Source notices travel with the finding

Finding pages show readable source credits, available source links, and complete supplied license notices. Email, Slack and Microsoft Teams finding alerts include these notices too. Notices are not shortened to fit a message.

If a complete alert exceeds a destination limit, delivery is marked failed before that message is sent. Review the finding and delivery history in Candler. A destination test has no real finding or vulnerability data and therefore carries no record notice.


## Independent records, visible limits

Source names identify where data comes from. They do not imply endorsement, partnership, certification, or complete security coverage.

A source may update or withdraw a record, and different sources may disagree. Keep the original evidence in view when choosing and testing a software update. This page is not a privacy policy or a replacement for the providers’ terms.


## Sources

- [Wordfence V3 feed documentation](https://www.wordfence.com/help/wordfence-intelligence/v3-accessing-and-consuming-the-vulnerability-data-feed/)
- [Wordfence Intelligence terms and conditions](https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/)
- [CVE Program terms of use for supplied MITRE notices](https://www.cve.org/Legal/TermsOfUse)
- [OSV documentation and source databases](https://google.github.io/osv.dev/)
- [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## More about Candler

- [How Candler works](https://candler.app/how-it-works)
- [Security and coverage](https://candler.app/security)
- [Roadmap](https://candler.app/roadmap)
- [Data sources and licenses](https://candler.app/data-sources)