@Ryan Hellyer - What are you talking about? Checkmarx creating an automated tool that scanned the plugins in their report. Doesn't that prove it's possible? The scanning would not be done by the plugin author but by the plugin review team. Any code that comes up as an SQL injection point or other type of vulnerability would all be publishing in a report. The plugin author gets the report with the details on which code is causing the flags to be drawn and the plugin is not accepted into the repo until it's scanned and comes up with a result of 0. No guarantee that everything will be found but damn, it has to be a better situation than what we have now.