In reply to nick6352683.

I'm not sure how the reskin of the plugin directory is at all involved in security, but regardless of that, but given that it only changed 2 days ago, I'm not sure how you expect us to measure "results" there without, you know, some meaningful amount of time passing.

Nevertheless, we do take plugin and theme security quite seriously. Plugins get updated and fixed all the time, and we're in constant communication with plugin authors to notify them of found issues and to get those issues fixed. There have been two plugins fixed this week, but then it's only Friday. We get a lot more security reports on the weekend.

Aside from that, there are many people scanning the directory for known issues (like timthumb) and several good researchers out there who report to the plugins team on a semi-monthly basis with new findings. There is no misrepresentation of the facts involved here; when security issues are found, they are either fixed, removed, or otherwise dealt with in the most appropriate manner. For severe or widespread issues, we've sometimes bypassed authors and made fixes directly to the affected plugins. For cases like timthumb, we've scanned the repository, done mass emails to authors, manually removed plugins or helped users to otherwise stop using broken and unmaintained ones, and generally done at best as is possible.

You seem to be overly focused on the fact that security issues exist at all. Sadly, that's not going to change for any project, ever. Mistakes are made and bugs happen. Our concern is to prevent the problems when possible and to mitigate issues as quickly as is feasible. The plugin directory is not guaranteed to be safe (it actually says that right in the white paper, again, please read it). However, we do our utmost to correct issues whenever they appear in the best way that we can.