In reply to Otto.

Christopher: If the Gutenberg Cloud project becomes bad by including malicious code, then we'd pull the plugin from the directory. Same as with any other security issue.

If they're not going to maintain their list of blocks and keep it secure, then we'll take actions then. But we're not going to condemn the idea outright because of the possibility.

Any plugin can include malicious code. We don't read every update. That's not actually possible. We trust authors until they violate that trust, and then we take appropriate steps. How else would you suggest that we do it?