Yes - your assesment is spot on, that's what I was trying to say.

As we now have CPAN ratings, maybe that could be extend to address user error and security concerns. Comments would have to pass through some moderation process and module authors should be given reasonable time to address such issues. If they fail to do so, then a caution should be logged against that module - this doesn't stop others from continuing to use it, but does ensure they are made aware of potential shortcomings.

Maybe something based around that would be possible?