# Know what runs. See what needs attention.

Source: https://candler.app/

Candler gives teams a shared inventory of WordPress plugins and GitHub dependencies, checks exact versions against known vulnerability records, and keeps findings, decisions, and alerts together.

## Bring your software

Add WordPress sites and plugin versions manually or by CSV. Connect selected GitHub repositories to import dependencies from root composer.lock and package-lock.json files. Adding a site URL alone does not discover its installed plugins.


## Review known risk

Wordfence supplies WordPress vulnerability records. OSV checks supported package versions. CISA Known Exploited Vulnerabilities (KEV) data identifies findings linked to known exploitation. Review source records and reported fixed versions before choosing an upgrade.


## Act as a team

Send test messages and finding alerts through email, Slack, and Microsoft Teams. Acknowledge findings, ignore them with a reason, or reopen them. Keep a record as software and decisions change.


## Understand the limits

A clean check means no known match in the checked source. It does not prove software is safe. Missing exact versions, unsupported inputs, failed checks, and missing lockfiles stay visible. GitHub access is read-only and repository code is not run. V1 is a limited pilot. A Dependabot read-only preview is available for selected repositories; other integrations remain planned.



## More about Candler

- [How Candler works](https://candler.app/how-it-works)
- [Security and coverage](https://candler.app/security)
- [Roadmap](https://candler.app/roadmap)
- [Data sources and licenses](https://candler.app/data-sources)