Using B (probably with some backend such as B::Terse, I can not imagine you want the bare B module) would only be a security issue if you want to highlight code submitted to your site by anyone, and he is not because of B itself so much as because using B requires Perl to have compiled the code, which is inseparably connected with the possibly of having code run at compile-time.