Unreviewed Crate Install Risk

Crates are treated as first-come, first-served, so uploading is effectively unpoliced and packages are not reviewed before publishing; users then install untrusted code unless an opt-in audit/review workflow (e.g., an Audit button) is used.