Security reports

We periodically re-scan the plugin ecosystem and record the changes: which plugins became high-risk, which issues got fixed. Frequency adapts — faster early on, weekly once stable.