While this practice is OK, I am not sure if Jenkins with its billions of trivial vulnerabilities in every other plugin is a poster child for security.

https://www.jenkins.io/security/advisories/