Codacy is a free code analysis tool which will help identify security problems in code.

The current list of issues found against master is here:

https://app.codacy.com/gh/fvwmorg/fvwm3/issues/index

It would be good if some/all of these are addressed via PRs. Some are easier to fix than others, so some of the suggestions might need discussion.