# Candler

> WordPress and GitHub vulnerability tracking for teams. A shared inventory, known findings, review history, and email, Slack, and Microsoft Teams alerts.

V1 limited pilot. Dependabot read-only preview available. A clean check is not proof that software is safe. This file describes public product information only.

## Product and roadmap

- [WordPress & GitHub vulnerability tracking | Candler](https://candler.app/index.md): Track WordPress plugins and GitHub dependencies, review known vulnerabilities, and send your team clear alerts with Candler.
- [Candler roadmap | V1 checks and V2 integrations](https://candler.app/roadmap.md): See the limited V1 pilot, the available Dependabot read-only preview, and planned integrations. Future features have no promised release dates.
- [How Candler works | Software vulnerability monitoring](https://candler.app/how-it-works.md): Learn how Candler checks WordPress plugins and GitHub lockfiles, groups known findings, tracks team decisions, and sends vulnerability alerts.
- [Candler security and coverage | Access and data handling](https://candler.app/security.md): Understand Candler’s read-only GitHub access, team access controls, secret handling, vulnerability sources, and limits of coverage.
- [Candler data sources and licenses | Source evidence](https://candler.app/data-sources.md): See how Candler uses Wordfence, OSV, CISA KEV and the optional GitHub Dependabot preview, preserves source notices, and links original records.
- [Compare Candler with other vulnerability tools](https://candler.app/compare.md): Compare Candler with Dependabot, Snyk, Patchstack, Wordfence Central, and OWASP Dependency-Track. Review strengths, limits, and planned integrations.
- [Candler vs Dependabot | GitHub and WordPress findings](https://candler.app/compare/dependabot.md): Compare Candler and GitHub Dependabot for dependency alerts, WordPress coverage, team review, and the optional read-only report preview.
- [Candler vs Snyk | Vulnerability tracking for teams](https://candler.app/compare/snyk.md): Compare Candler’s WordPress and GitHub review workflow with Snyk Open Source. See current limits and requirements for a proposed Snyk connector.
- [Candler vs Patchstack | WordPress vulnerability monitoring](https://candler.app/compare/patchstack.md): Compare Candler’s inventory and findings workflow with Patchstack’s vulnerability services. Understand monitoring, protection, and the proposed V2 integration.
- [Candler vs Wordfence Central | Team security workflows](https://candler.app/compare/wordfence-central.md): Compare Candler and Wordfence Central for WordPress security workflows. Learn the difference between Candler’s Wordfence data feed and a Central connection.
- [Candler vs Dependency-Track | Inventory and known risk](https://candler.app/compare/dependency-track.md): Compare Candler’s WordPress and GitHub scope with OWASP Dependency-Track’s broader component inventories, and review the proposed V2 connection.

## Full public reference

- [Expanded Candler reference](https://candler.app/llms-full.txt): Combined public product, roadmap, coverage, and comparison content.