the vulnerability plugin has been officially decoupled and documented