I wish that the WMF spent some of their mountain of cash on programmer time on security reviews of the extensions in the Mediawiki ecosystem. Instead, it feels

I wish that the WMF spent some of their mountain of cash on programmer time on security reviews of the extensions in the Mediawiki ecosystem. Instead, it feels like it's mainly just me in my free time, as part of my efforts for the nonprofit wiki farm, miraheze.org. The WMF does a great job on any code used on or produced for WMF servers, but for the other extensions listed on mediawiki.org, it's a smorgasbord of XSS and SQLI. A lot of those are git hosted by the WMF too, so don't use the hosting location as any indication of security.