Over 250 installs on: Sentinel and CMS security for Statamic

CMS security usually lives out of sight. The packages, versions and dependencies that run your website sit in files most people never open, quietly going out of date until something breaks or gets exploited.

Sentinel, my platform and dependency audit addon for Statamic, has just passed 250 installs on Packagist. If you are one of the people who installed it, thank you. It started as a tool I built to help with my own maintenance work, and it turned into something a few hundred other sites now rely on too.

Over 250 installs, and a thank you

250 is not a huge number by the standards of the big package registries, but for a niche addon in the Statamic ecosystem it means a lot (to me). Every install is a site owner or agency who wanted a clearer view of what their website is actually built from.

What Sentinel actually does

Sentinel reads the versions installed on your site and cross-references them against the sources that actually know whether something is safe or stale:

• The OSV vulnerability database, for known security issues in your packages.

• endoflife.date, to tell you when your PHP version stops getting security fixes.

• Packagist and the npm registry, to check what you have installed against the latest available release.

It then displays the findings directly in the Statamic Control Panel: vulnerabilities by severity, packages past their end of life, and updates you have not taken yet. No terminal, no separate dashboard. It sits in the CP where the rest of the site is managed.

Surfacing what your composer and npm packages are hiding

Non-technical site owners never see this layer. Your website runs on two sets of dependencies: Composer packages on the back end and npm packages for the front-end build. Both are pinned in lockfiles, composer.lock and package-lock.json, that record the exact version of every single thing your site depends on. Nobody reads those files by choice.

Sentinel reads them for you and turns them into something legible. It shows your Statamic version against the latest stable release, your PHP version with its lifecycle status, and a per-package view of what is vulnerable, outdated or unsupported.

It also keeps a rolling 365-day history. Every time a tracked value changes, it records a snapshot, so you can diff two points in time and see exactly what moved between updates: which packages changed version, what got added or removed, which vulnerabilities were resolved and which were introduced. That turns a vague sense of "the site got updated at some point" into a clear record.

The dependencies that power your website are invisible until they cause a problem. Sentinel makes them visible before they do.

Notify: coordinating updates without disrupting the site

The newest addition is Notify, which landed in version 2.0.0 on 30 June 2026. It solves a problem that only shows up on real client sites: what happens when a developer needs to run updates on a Control Panel that editors are also using?

Notify coordinates that update window for everyone who shares the Control Panel. You schedule a heads-up email so editors know work is coming. Banners then run through the lifecycle of the job inside the Control Panel: an upcoming notice, an active state while the work is in progress, and an all-clear once it is done. When the update finishes, everyone gets told.

Crucially, none of this touches the public site. The front end stays live and unaffected throughout. Notify only changes what people see inside the Control Panel, so visitors never know an update happened, which is exactly how it should be.

Seeing the problem is not the same as fixing it

Here is the honest limit of any audit tool. Sentinel tells you a package is three versions behind, or that a critical vulnerability is sitting in your dependency tree, or that your PHP version is out of date. It does not update anything for you. That still takes someone who knows what to touch, in what order, and how to test that nothing broke afterwards.

That is what my Statamic maintenance plan is for. Across the Core, Plus and Max tiers I handle monthly CMS updates, Composer and npm dependency updates, and post-update reports so you can see what changed. Sentinel is the eyes; maintenance is the hands.

Plenty of people run Sentinel happily on their own, and I am glad the addon is useful on its own terms. But if you would rather not think about any of it, that is the service. Sentinel shows you the problem, and I handle it for you.

Sentinel is free and open source. You can view the repository on GitHub, read the docs, and install it on any Statamic 3, 4, 5 or 6 site. Thank you again to everyone who got it past 250 installs. Here's to the next 250.