Security reports

We scan the registry daily and archive a report each week: which plugins entered or cleared a high-risk tier, which issues got fixed, and where the model-driven dynamic audit raised or lowered a tier. The tier is not a single static rule — a dynamic conclusion is authoritative where one exists, and the static scan tier applies only where there is none.

Two inputs, one output: (1) a deterministic static scan over the whole registry (vet as primary judge with dsh as backstop); (2) a model-driven dynamic audit that reads redacted source context without executing plugin code, covering only the subset whose static tier is medium or above. A dynamic conclusion sets the published tier where one exists (it may raise or lower it); otherwise the static tier applies. Recording `withdrawn` in the review table reverts to the static tier immediately. Exemptions stay manual — the audit script never writes the suppression list. Current data: 2,925 audit records, 2,341 with a model conclusion, 2,340 in force (321 raised / 794 lowered), 1 withdrawn by human review. Entries outside the scanning scope are excluded from the registry-wide numbers and their badge reads pending; the detail page and per-plugin JSON are their authoritative tier.