@Ted Clayton - I've reached out to Checkmarx to see if they are willing to participate in either a Google Hangout with me or a recorded Skype call so we can learn more about their process of scanning those plugins on the repository.