Brakeman is there: http://ci.theforeman.org/job/test_brakeman (although that's going to be deleted soon). The Rails 5.2 warnings can be seen in the new deprecations in https://github.com/theforeman/foreman/pull/5428

I started with Brakeman scan and `grep` and with Foreman only and did not spend much time on this yet.

I think that basic checking should be done on regular basis possibly as part of the CI and also for plugins. Brakeman can be used and/or services such as Hakiri (https://hakiri.io/).

I don't have a list of issues. Initial one can be obtained by running Brakeman.

In my opinion as a starting point all issues reported by Brakeman should be fixed or marked as false positives in the Brakeman config file (to be included with Foreman).