Would it be reasonable to require a security reporting URL for any runtime seeking to be added to a registry?