SLB-Impact Sentinel – Addon Monitor & Risk Scanner

Description

Impact Sentinel keeps watch over your WordPress plugins so you do not have to. When a plugin updates, it fetches the changelog, scores it against a risk keyword list, and sends you an email alert — before you decide whether to apply or roll back the update.

Know what changed before it breaks anything.

Most WordPress sites apply plugin updates without reading what changed. Impact Sentinel reads the changelog for you, flags risky updates (breaking changes, deprecated APIs, security patches), and gives you the information to make an informed decision — not just a blind click on “Update All.”

How it works

1. Impact Sentinel runs a scan on your installed plugins — either triggered manually from the dashboard or automatically on a schedule (Pro).
2. When a version change is detected, it fetches the changelog from the plugin’s readme, the WP.org API, or a configured URL.
3. The changelog is scored against a tiered risk keyword list — security terms, breaking change indicators, deprecations, and more.
4. If the risk score meets your configured threshold, an email alert is sent to your team.

No AI required. No external account required. Changelog scanning and email alerts work out of the box.

Plugin Discovery & Inventory

On first run, Impact Sentinel scans all installed plugins and builds a persistent inventory. Classify each plugin by tier — Self-Managed (your code), WP.org (community), or Premium (paid third-party) — and mark which ones you own or actively maintain. Classification context appears on every alert so your team knows what they are looking at.

Plugins can declare their dependencies using the standard WordPress Requires Plugins header. Impact Sentinel reads these declarations automatically and seeds the dependency map without any manual input.

Changelog Scanning

Impact Sentinel resolves changelogs through six sources in priority order:

• Manual paste — for plugins behind member portals or login walls, paste the changelog text directly into the alert card
• Local readme.txt or CHANGELOG.md — reads the file on disk before making any network request
• WP.org API — the structured changelog endpoint, not a scrape
• Saved URL — a specific changelog URL you have configured for that plugin
• URL probe — automatic HEAD requests to common changelog paths (/changelog/, /release-notes/)
• Fallback label — when no text is available, the alert is created with a note to check manually

Risk Keyword Scoring

Changelogs are scored against a tiered keyword list. The high tier includes security-focused terms: CVE, XSS, SQL injection, RCE, authentication bypass, privilege escalation, unauthenticated, vulnerability, and more. Medium and low tiers cover breaking changes, deprecations, and general notices.

The keyword list is fully customizable in Settings — add your own global terms, or set per-plugin overrides with Impact Sentinel Pro.

Email Alerts

When a scan finds a version change and the changelog scores above your configured threshold, an alert is sent to your recipient list. Set the threshold to Critical only, High and above, Medium and above (recommended), or All. Alerts include the plugin name, version arrow, matched keywords, and a changelog excerpt.

Relationship Map & Dependency Matrix

Map which plugins your custom code depends on. The dependency matrix shows which of your owned plugins would be affected if a given third-party plugin introduced a breaking change. Auto-detection scans your plugin source files and proposes likely dependencies. All relationships can be confirmed, dismissed, or added manually.

Work Queue

When an alert is created, a corresponding work queue item is added for your team. Resolve items with notes, set a default assignee, and track what was done about each update.

Pending Updates Panel

The dashboard shows all WordPress-tracked pending updates for your monitored plugins before they are applied — with version arrows and classification badges so you know which updates need a closer look before you click Update.

Pro Features

Impact Sentinel Pro adds automated nightly scanning, Stage 1 and Stage 2 Claude AI impact analysis, Code Graph (maps which of your functions call into updated dependencies), Conflict Scanner, WP Core monitoring, file integrity monitoring, WPScan CVE vulnerability feed, weekly digest emails, queue history, per-plugin keyword overrides, AI model selection, config export / import, and Safe Update pre-update risk analysis (a risk verdict badge on the Plugins page, with the option to block or warn before auto-updates apply).

Learn more at spartanlogicbuilders.com/impact-sentinel/

Features

• Plugin discovery and inventory — classify all installed plugins by tier and ownership
• Version change detection with configurable minimum bump threshold
• Changelog fetch from six sources including local files and WP.org API
• Risk keyword scoring — high / medium / low tiers, fully customizable
• Email alerts with configurable threshold and multiple recipients
• Manual changelog paste-in for premium plugins behind member portals
• Relationship map and dependency matrix
• Work queue — resolve and track alert action items
• Pending updates panel on the dashboard
• Scan history with type badges, duration, alert count, and site health check
• Manual scan trigger from the dashboard
• API key via wp-config.php constant or plugin settings UI (AES-256-GCM encrypted)

Requirements

No external account or API key is required to use Impact Sentinel.

Email alerts use WordPress’s built-in wp_mail function — delivered through whatever mail configuration your site already has.

AI features (Stage 1 and Stage 2 Claude impact analysis) require an Anthropic API key and are available in Impact Sentinel Pro only.

External Services

This plugin connects to the following external services:

WordPress.org Plugin API (Free)
Fetches structured changelog text for plugins listed on WordPress.org.
URL: https://api.wordpress.org/plugins/info/1.0/{slug}.json
Data sent: Plugin slug only. No visitor or site owner data is transmitted.
Privacy policy: https://wordpress.org/about/privacy/

Anthropic API (optional — requires API key)
Used for AI-powered changelog impact analysis (Stage 1 and Stage 2).
URL: https://api.anthropic.com/v1/messages
Data sent: Changelog text and plugin source file excerpts. No visitor data is transmitted.
Privacy policy: https://www.anthropic.com/privacy

WPScan API (optional — requires API key)
Checks installed plugins against known CVE vulnerability records.
URL: https://wpscan.com/api/v3/
Data sent: Plugin slugs and version numbers. No visitor or site owner data is transmitted.
Privacy policy: https://automattic.com/privacy/

Privacy

No data leaves your site by default.

All plugin data, scan results, alerts, and queue items are stored locally in your WordPress database. Impact Sentinel does not transmit analytics, telemetry, or usage data to Spartan Logic Builders or any third party.

Changelog fetching (optional network requests):

When Impact Sentinel fetches a changelog, it makes an outbound HTTPS request to:
* api.wordpress.org — the WordPress.org plugin info API (only for plugins with a WP.org listing)
* A URL you have configured for a specific plugin
* A probe of common changelog paths on the plugin’s declared Plugin URI

These requests are made by the server, not the visitor’s browser. No visitor data is transmitted.

If you enable AI features (optional):

AI analysis transmits changelog text and plugin source file excerpts to the Anthropic API (api.anthropic.com) over HTTPS. No visitor data is ever transmitted. Refer to Anthropic’s privacy policy at https://www.anthropic.com/privacy for details.

WPScan vulnerability feed (optional):

Requires a WPScan API key. Plugin slugs and version numbers are transmitted to wpscan.com to check for known CVEs. No visitor or site owner data is transmitted. WPScan is operated by Automattic — refer to their privacy policy at https://automattic.com/privacy/ for details.