=== CodeMedic SupplyScope ===
Contributors: adrianmikula
Tags: security, dependencies, composer, vulnerabilities, cve
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later

Scans WordPress plugins for vulnerable Composer dependencies and reports CVEs before they become breaches.

== Description ==

CodeMedic SupplyScope detects vulnerable Composer packages bundled within your WordPress plugins. Every hour, it scans your active plugins against a continuously updated CVE intelligence feed and displays the results in a clear admin dashboard.

Stop guessing which plugins have unpatched vulnerabilities. Get visibility into the hidden dependency chain of every plugin on your site.

= How It Works =

1. **Discovery** — Every hour, the plugin scans all active WordPress plugins for bundled Composer dependencies and checks them against our cloud CVE API.
2. **Review** — Detected vulnerabilities are listed in the admin screen with CVE details, severity, and affected library information.
3. **Act** — The plugin reports what's vulnerable so you can take action — whether that means updating the plugin, replacing it, or applying patches manually.

= Why Dependency Scanning? =

WordPress plugins often bundle Composer dependencies (Guzzle, Monolog, PHPUnit, etc.) directly in their vendor directory. Plugin authors may not update these dependencies promptly after a CVE is disclosed. Without a scanner, you have no visibility into these hidden risks.

Patchstack and Wordfence block exploit attempts at the perimeter. This plugin tells you what's vulnerable so you can take action — whether that means updating the plugin, replacing it, or applying patches manually.

== External Services ==

This plugin queries several third-party vulnerability databases to detect known CVEs in Composer dependencies bundled by your WordPress plugins. No personally identifiable information is transmitted. Each service is described below.

=== OSV.dev ===

What it is: OSV.dev is an open-source vulnerability database maintained by Google. It is used to look up known vulnerabilities in Composer (Packagist) packages.

Data sent: Composer package names and version numbers are sent as JSON in a batch query.

When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.

Terms of Service: https://google.github.io/osv.dev/
Privacy Policy:   https://policies.google.com/privacy

=== National Vulnerability Database (NVD) ===

What it is: The NVD is a public vulnerability database maintained by NIST (U.S. National Institute of Standards and Technology). It is used to search for CVEs related to WordPress plugins by keyword.

Data sent: The WordPress plugin name is sent as a keyword search query parameter. No personal data is transmitted.

When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.

Terms of Service: https://nvd.nist.gov/developers/terms-of-use
Privacy Policy:   https://www.nist.gov/privacy-policy

Note: This product uses data from the NVD API but is not endorsed or certified by the NVD.

=== WPVulnerability.net ===

What it is: WPVulnerability.net is an open-source WordPress vulnerability database. It provides aggregated vulnerability data for WordPress core, plugins, and themes.

Data sent: The WordPress plugin slug is sent as part of the API URL path. No personal data is transmitted.

When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.

Terms of Service: https://www.wpvulnerability.com/license/
Privacy Policy:   https://www.wpvulnerability.com/privacy/

=== WordPress.org Plugin API ===

What it is: The official WordPress.org plugin information API. It is used to retrieve plugin metadata (such as the current stable version and last updated date) to calculate patch velocity metrics.

Data sent: The WordPress plugin slug is sent as a query parameter. No personal data is transmitted.

When: On every scheduled scan and when a manual scan is triggered from the admin dashboard.

Terms of Service: https://wordpress.org/about/privacy/
Privacy Policy:   https://wordpress.org/about/privacy/

== Installation ==

1. Upload the `codemedic-supplyscope` folder to the `/wp-content/plugins/` directory.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. The plugin begins scanning hourly for vulnerable dependencies. Review findings from Tools > Dep Scanner.

== Frequently Asked Questions ==

= Does this plugin modify my files? =

No. The free version is read-only — it scans and reports vulnerabilities but never modifies any files.

= How do I fix the vulnerabilities this plugin finds? =

Update the affected plugin if a newer version is available, replace it with an alternative, or use the patch history to manually apply fixes.

= Can I use this alongside other security plugins? =

Yes. This plugin is complementary to firewalls and WAFs. It focuses on visibility into bundled Composer dependencies that other tools don't inspect.

== Screenshots ==

1. The admin screen showing detected vulnerabilities with CVE details.

== Changelog ==

= 1.0.0 =
* Initial release.
* Hourly scanning of active plugins for bundled Composer dependencies.
* Cloud-based CVE intelligence feed.
* Read-only vulnerability dashboard with CVE details and severity.
* Patch history log.
* Patch history log for audit and manual remediation.
