# A clearer view. One step at a time.

Source: https://candler.app/roadmap

The limited V1 pilot is running, and the Dependabot read-only preview is available. Next work will extend review and alerts while preserving source details and keeping disagreements visible.

Available features are labelled below. Remaining work is planned, not promised. Order and scope may change. No release dates are committed.

## Keep the foundation clear

Status: Now / V1 limited pilot

V1 brings together WordPress inventories, selected GitHub lockfiles, known vulnerability checks, team decisions, audit history, and email, Slack, and Teams alerts. The limited pilot keeps recovery and accessibility limits visible.

- Keep source freshness and failed checks visible.
- Continue broader accessibility and recovery verification.
- Review pilot evidence before expanding the release.

## Dependabot read-only preview

Status: Available / V2.0 preview

Read Dependabot reports from explicitly selected repositories after the owner approves Dependabot alerts read access. Keep original report evidence, GitHub state, and source links separate from Candler decisions. The preview sends no alerts.

- Compare related root-package findings without merging source records.
- Keep nested manifests, unknown versions, and ambiguous matches visible.
- Choose manual refresh or opt in to automatic refresh per repository.

## Extend review without duplicate alerts

Status: Next / V2.0 work in progress

Build on the read-only preview with carefully defined shared finding identities and notification rules. Imported reports do not currently create Candler finding alerts or change matched/clean counts.

- Preserve source disagreements and separate review decisions.
- Verify reconnect, failure recovery, and scheduled operation.
- Test alert identities before enabling provider-report notifications.

## Add a second WordPress source

Status: Later / Proposed V2.1

Evaluate Patchstack as an additional source of WordPress vulnerability records or findings from a connected account. Access, permitted use, and cost must be confirmed before implementation.

- Compare source version ranges and identifiers.
- Preserve conflicting reports instead of silently choosing one.
- Test changes, withdrawals, and repeat-alert prevention.

## Bring in broader software inventories

Status: Later / Proposed V2.2

Evaluate a read-only connection to an existing OWASP Dependency-Track installation. Its software component inventories could broaden Candler’s view beyond the lockfiles supported in V1.

- Map only the projects the team chooses.
- Retain component identity, project version, and source evidence.
- Keep an incomplete import separate from a clean check.

## Connect existing Snyk accounts

Status: Conditional / Proposed V2.3

Evaluate importing findings for teams that already have the required Snyk access. Current Snyk documentation requires an Enterprise plan for API access. This is conditional on a suitable account and a useful customer need.

- Use a dedicated service account and the correct service region.
- Start with software dependency findings, not every Snyk product.
- Apply the same grouping, privacy, and alert checks as other sources.

## Explore Wordfence Central

Status: Research / No committed scope

Candler already uses Wordfence vulnerability data. Importing a customer’s Wordfence Central site findings would be a different integration. We will first check whether a supported, authorized integration is available. No Central connector is promised.


## What will not change

Candler is a record of known risk and team decisions. It will continue to show the source, checked version, coverage limits, and freshness of a result. A planned connector is not a claim of partnership, complete coverage, or automatic protection.



## More about Candler

- [How Candler works](https://candler.app/how-it-works)
- [Security and coverage](https://candler.app/security)
- [Roadmap](https://candler.app/roadmap)
- [Data sources and licenses](https://candler.app/data-sources)