A clearer view. One step at a time.

V1 brings together WordPress inventories, selected GitHub lockfiles, known vulnerability checks, team decisions, audit history, and email, Slack, and Teams alerts. The limited pilot keeps recovery and accessibility limits visible.

• Keep source freshness and failed checks visible.
• Continue broader accessibility and recovery verification.
• Review pilot evidence before expanding the release.

Read Dependabot reports from explicitly selected repositories after the owner approves Dependabot alerts read access. Keep original report evidence, GitHub state, and source links separate from Candler decisions. The preview sends no alerts.

• Compare related root-package findings without merging source records.
• Keep nested manifests, unknown versions, and ambiguous matches visible.
• Choose manual refresh or opt in to automatic refresh per repository.

Build on the read-only preview with carefully defined shared finding identities and notification rules. Imported reports do not currently create Candler finding alerts or change matched/clean counts.

• Preserve source disagreements and separate review decisions.
• Verify reconnect, failure recovery, and scheduled operation.
• Test alert identities before enabling provider-report notifications.

Evaluate Patchstack as an additional source of WordPress vulnerability records or findings from a connected account. Access, permitted use, and cost must be confirmed before implementation.

• Compare source version ranges and identifiers.
• Preserve conflicting reports instead of silently choosing one.
• Test changes, withdrawals, and repeat-alert prevention.

Evaluate a read-only connection to an existing OWASP Dependency-Track installation. Its software component inventories could broaden Candler’s view beyond the lockfiles supported in V1.

• Map only the projects the team chooses.
• Retain component identity, project version, and source evidence.
• Keep an incomplete import separate from a clean check.

Evaluate importing findings for teams that already have the required Snyk access. Current Snyk documentation requires an Enterprise plan for API access. This is conditional on a suitable account and a useful customer need.

• Use a dedicated service account and the correct service region.
• Start with software dependency findings, not every Snyk product.
• Apply the same grouping, privacy, and alert checks as other sources.

Candler already uses Wordfence vulnerability data. Importing a customer’s Wordfence Central site findings would be a different integration. We will first check whether a supported, authorized integration is available. No Central connector is promised.

Candler is a record of known risk and team decisions. It will continue to show the source, checked version, coverage limits, and freshness of a result. A planned connector is not a claim of partnership, complete coverage, or automatic protection.