From software inventory to a useful next step.

For WordPress, create a site and add plugin slugs and exact versions manually or through CSV. A site address is a label for the inventory, not a remote scan that discovers plugins.

For GitHub, authorize selected repositories and add them to your team. V1 imports root composer.lock and package-lock.json files from the default branch. Nested lockfiles, other lockfile formats, and version ranges in manifests are outside this import’s coverage.

WordPress checks use Wordfence records. Supported package checks use OSV. CISA’s Known Exploited Vulnerabilities catalog adds context about known exploitation when identifiers match.

The source’s affected ranges, identifiers, severity, and reported fixed versions remain available for review. A reported fix for one advisory may not fix every finding affecting that component.

Matched means a component has a known vulnerability match. Clean means no known match in the source checked. Not checked means Candler lacks a completed, supported check, for example because an exact version or lockfile is missing.

These counts describe components, not the number of advisories. A single component can have several findings. A failed check does not turn an earlier affected component into a clean one.

Findings can be acknowledged, ignored with a reason, or reopened. Candler keeps the change history. Acknowledging a finding records a decision; it does not fix the software.

A later successful check can resolve a finding when the updated or removed component is no longer affected. The record remains available rather than disappearing from history.

Configure email, Slack, or Microsoft Teams destinations and confirm arrival with a test. Rules control the minimum severity and whether ordinary new findings send immediately or in a daily summary.

A finding newly linked to CISA KEV sends an immediate escalation, bypassing ordinary timing and severity rules. Repeat scans do not intentionally resend the same discovery alert. Adding a destination does not automatically replay all older findings.