I'm late to the game, as usual (busy like the devil). Still reading the other 7 pages. All I can say at this point is babysit each and every outside link inside your Member Areas like they were a guest in your home. Hell, I even have a well seasoned Member or two on "password payroll" to check stuff and hand in weekly reports, hehe.
Doesn't matter what it is or who it's from. I could buy plugins from my Mom and I would still check them out regularly, more for errors and such, but you get my point.
