Maypole uses CGI::Untaint for all its validation, and it is pretty strong on that side. I switched Taint protection on fairly late in the process, and did not need to change any line of code in either Maypole or my additional code, as Maypole educates the user in a fairly controlled manner to always properly untaint the data.

Personally, I'm no big fan of TT, as it allows to do far too much in the custom language instead of pushing complex things back to the Model layer. I prefer the Petal approach of things, where simple things, such as method calls are possible, and everything harder must be implemented in Perl code in the relevant class.