SLB-Impact Sentinel - Addon Monitor & Risk Scanner

Impact Sentinel keeps watch over your WordPress plugins so you do not have to. When a plugin updates, it fetches the changelog, scores it against a risk keyword list, and sends you an email alert — before you decide whether to apply or roll back the update. Know what changed before it breaks anything. Most WordPress sites apply plugin updates without reading what changed. Impact Sentinel reads the changelog for you, flags risky updates (breaking changes, deprecated APIs, security patches), and gives you the information to make an informed decision — not just a blind click on "Update All." How it works

1. Impact Sentinel runs a scan on your installed plugins — either triggered manually from the dashboard or automatically on a schedule (Pro).
2. When a version change is detected, it fetches the changelog from the plugin's readme, the WP.org API, or a configured URL.
3. The changelog is scored against a tiered risk keyword list — security terms, breaking change indicators, deprecations, and more.
4. If the risk score meets your configured threshold, an email alert is sent to your team.

No AI required. No external account required. Changelog scanning and email alerts work out of the box. Plugin Discovery & Inventory On first run, Impact Sentinel scans all installed plugins and builds a persistent inventory. Classify each plugin by tier — Self-Managed (your code), WP.org (community), or Premium (paid third-party) — and mark which ones you own or actively maintain. Classification context appears on every alert so your team knows what they are looking at. Plugins can declare their dependencies using the standard WordPress Requires Plugins header. Impact Sentinel reads these declarations automatically and seeds the dependency map without any manual input. Changelog Scanning Impact Sentinel resolves changelogs through six sources in priority order:

• Manual paste — for plugins behind member portals or login walls, paste the changelog text directly into the alert card
• Local readme.txt or CHANGELOG.md — reads the file on disk before making any network request
• WP.org API — the structured changelog endpoint, not a scrape
• Saved URL — a specific changelog URL you have configured for that plugin
• URL probe — automatic HEAD requests to common changelog paths (/changelog/, /release-notes/)
• Fallback label — when no text is available, the alert is created with a note to check manually

Risk Keyword Scoring Changelogs are scored against a tiered keyword list. The high tier includes security-focused terms: CVE, XSS, SQL injection, RCE, authentication bypass, privilege escalation, unauthenticated, vulnerability, and more. Medium and low tiers cover breaking changes, deprecations, and general notices. The keyword list is fully customizable in Settings — add your own global terms, or set per-plugin overrides with Impact Sentinel Pro. Email Alerts When a scan finds a version change and the changelog scores above your configured threshold, an alert is sent to your recipient list. Set the threshold to Critical only, High and above, Medium and above (recommended), or All. Alerts include the plugin name, version arrow, matched keywords, and a changelog excerpt. Relationship Map & Dependency Matrix Map which plugins your custom code depends on. The dependency matrix shows which of your owned plugins would be affected if a given third-party plugin introduced a breaking change. Auto-detection scans your plugin source files and proposes likely dependencies. All relationships can be confirmed, dismissed, or added manually. Work Queue When an alert is created, a corresponding work queue item is added for your team. Resolve items with notes, set a default assignee, and track what was done about each update. Pending Updates Panel The dashboard shows all WordPress-tracked pending updates for your monitored plugins before they are applied — with version arrows and classification badges so you know which updates need a closer look before you click Update. Pro Features Impact Sentinel Pro adds automated nightly scanning, Stage 1 and Stage 2 Claude AI impact analysis, Code Graph (maps which of your functions call into updated dependencies), Conflict Scanner, WP Core monitoring, file integrity monitoring, WPScan CVE vulnerability feed, weekly digest emails, queue history, per-plugin keyword overrides, AI model selection, config export / import, and Safe Update pre-update risk analysis (a risk verdict badge on the Plugins page, with the option to block or warn before auto-updates apply). Learn more at spartanlogicbuilders.com/impact-sentinel/ Features

• Plugin discovery and inventory — classify all installed plugins by tier and ownership
• Version change detection with configurable minimum bump threshold
• Changelog fetch from six sources including local files and WP.org API
• Risk keyword scoring — high / medium / low tiers, fully customizable
• Email alerts with configurable threshold and multiple recipients
• Manual changelog paste-in for premium plugins behind member portals
• Relationship map and dependency matrix
• Work queue — resolve and track alert action items
• Pending updates panel on the dashboard
• Scan history with type badges, duration, alert count, and site health check
• Manual scan trigger from the dashboard
• API key via wp-config.php constant or plugin settings UI (AES-256-GCM encrypted)

Requirements No external account or API key is required to use Impact Sentinel. Email alerts use WordPress's built-in wp_mail function — delivered through whatever mail configuration your site already has. AI features (Stage 1 and Stage 2 Claude impact analysis) require an Anthropic API key and are available in Impact Sentinel Pro only.

2.2.5

• Removed the last locked/restricted-functionality signal flagged under Guideline 5 (trialware): the full AI model list and saved-model lookup were still present as dead code in the Free build's Claude analyzer class, even though the active code path already hardcoded Claude Haiku and the Settings UI already presented model choice as a Pro feature. That support code (and the equivalent OpenAI/Gemini provider-key and model-list code) is now excluded from the Free build entirely.
• Removed an unreachable Pro upgrade-installer method left as a dead stub in the Free build (its AJAX hook was already excluded from Free, but the method itself, including the string "Pro feature", still shipped)
• Removed a Pro-only admin view (owned-plugin file access, used only for Code Graph) that shipped in the Free build as an inert single-line stub file, invisible to normal navigation but still present on disk — a gap in the Free build's automated orphan-file removal that only caught the more common two-line boilerplate pattern; the build script's check is now more robust
• Corrected the readme.txt privacy disclosures to remove a data-collection entry describing a Pro-only upgrade flow that has no functioning code path in this Free build

2.2.4

• Removed the Safe Update pre-update analyzer and plugins.php risk badge from the Free build entirely — this Pro-only feature previously shipped as two unbootstrapped class files with no way to run, which is itself a locked/restricted-functionality signal under Guideline 5; corrected the readme changelog and in-app Free vs Pro comparison to consistently describe it as a Pro feature
• Replaced remaining direct fopen()/fread()/file_get_contents() calls on local files with the WP_Filesystem API across Discovery, changelog fetching, and dependency auto-detection, including one instance still flagged after the 2.2.3 fopen()/fread() swap
• Fixed a PHP fatal parse error in the Settings screen license tab (Pro build only; not present in the Free build, which strips the affected code) caused by a stray else with no matching if

2.2.3

• Removed remaining locked/restricted-functionality signals flagged under Guideline 5 (trialware): the AI model/provider selection form fields are now correctly stripped from the Free build's save handler (previously reachable even though the Settings UI already hid them), and 14 Pro-only class/view files that shipped as unbootstrapped stubs are now excluded from the Free package entirely
• Reworded Free-tier AI model messaging to describe what Impact Sentinel Pro adds as a separate product, rather than describing Free functionality as "locked"
• Replaced direct file_get_contents() calls on local plugin files with fopen()/fread() across Discovery, changelog fetching, and dependency auto-detection
• Corrected an invalid WPScan privacy policy URL in this readme (wpscan.com/privacy returns 404; WPScan is Automattic-owned, now points to automattic.com/privacy)
• Activation-triggered background source/changelog resolution now correctly respects the external-requests consent setting before making any outbound request
• Version number synchronized across plugin header, version constant, and this readme (previously drifted out of sync between releases)

2.2.0

• Added consent card — all external network requests (WP.org API, changelog URL probes, AI analysis) are now gated behind a one-time admin consent prompt on first use
• Extracted all inline scripts and styles to enqueued asset files for improved Content Security Policy compatibility
• Fixed database migration stability — corrected option read and value serialization in upgrade routines
• Plugin renamed to SLB-Impact Sentinel for WordPress.org submission; text domain updated to slb-impact-sentinel

2.1.6

• Renamed database columns claude_summary and claude_stage to ai_summary and ai_stage (provider-agnostic names; migration runs automatically)
• Fixed Google Fonts external import in Help & About page (replaced with system font stack)
• Fixed bare function names to use imsn_ prefix throughout

2.1.5

• Fixed update badge JavaScript selector — badge now reliably appears on the WordPress plugins page

2.1.4

• Fixed fatal error on plugins.php when WordPress passes null to auto-update filter
• Fixed all Settings form fields not saving after v2.1.1 prefix rename
• AI analysis tab restructured — provider selector now first, LLM-agnostic labels, updated model lists

2.1.3

• Fixed tab navigation broken across all admin views after v2.1.1 prefix rename

2.1.2

• Fixed API key not saving after v2.1.1 prefix rename (JS/PHP field name mismatch)

2.1.1

• Internal prefix rename for WordPress.org compliance — no functional changes

2.1.0

• Added Safe Update: Pre-Update Intelligence — risk verdict badge on plugins.php, blocks or warns before auto-updates based on changelog analysis (Pro)
• Multi-provider AI support — Anthropic, OpenAI GPT-4o, Google Gemini selectable in Settings (Pro)

2.0.0

• Visual Dependency Map — SVG force-directed graph of plugin relationships (Pro)
• WordPress Admin Dashboard Widget — last scan, open alerts, pending updates
• Conflict Scanner — detects hook collisions and namespace conflicts between any two plugins (Pro)
• Code Graph split into Impact Analysis and Conflict Scanner sub-tabs

1.9.2

• Added Schedule tab in Settings — consolidated run time, scan frequency, and a live overview of all seven background jobs and their next scheduled run
• Completed Free/Pro tagging pass across all PHP classes, templates, and JavaScript

1.9.1

• Security hardening: path traversal fix in plugin access verification, status allowlist on alert update, uncast ID echoes corrected in queue view, unguarded wp_kses corrected in scan history
• Fixed wrong API key constant reference (LF_ → PS_) in settings template
• Applied Free/Pro build markers across admin views, cron class, notifier, alert engine, data port, and main plugin file

1.9.0 Initial public release.

• Plugin discovery and inventory with tier and ownership classification
• Version change detection with configurable bump threshold
• Six-source changelog pipeline including Update Interceptor for zip installs
• Tiered risk keyword scoring with security-focused defaults
• Email alerts with configurable threshold and recipients
• Manual changelog paste-in for member-portal plugins
• Relationship map, dependency matrix, and auto-detection
• Work queue with resolve, dismiss, and default assignee
• Pending updates panel on dashboard
• Scan history with site health check column
• Manual scan trigger
• WP event hooks — scan fires automatically on plugin update, activation, auto-update, and recovery mode