Security audit burndown from live GitHub data

In September 2026 we had 30 days to close out 410 security issues across ten plugins. The risk with a program like that isn’t the work; it’s that nobody can see whether it’s on track until it’s too late.

I built a script that pulls live issue data from GitHub, computes the burndown against the deadline, and publishes it as a hosted page the whole team could check. Daily RAG status digests fed from the same data went out automatically.

It became the template for how we now run any time-boxed program: make the numbers visible early, and let the chart do the nagging.