A few libraries have asked recently if, prior to production/during the development lifecycle, automated source code analysis tools are used to test for security flaws specifically. Typically these questions are in relation to processes like renewing cybersecurity insurance or initial discovery by a potential partner library's security/IT department. Perlcritic seems to be currently used, but as far as I can tell it appears the tests are for enforcing the coding standard. Using an automated tool to look for security flaws will be a beneficial addition to the project, so I'd like to at least start the discussion here. OWASP has an informational page for further reading: https://owasp.org/www-community/controls/Static_Code_Analysis
I think it's an interesting idea that we should certainly explore. I remember hearing about RATS but I don't think it's actually maintained: https://manpages.ubuntu.com/manpages/trusty/man1/rats.1.html I didn't realise until now but Perl::Critic apparently does have a "security" theme. I think this is probably the direction we should pursue. We could always develop our own Perl::Critic policies (which leverages PPI under the hood).