rust-security

Audit Rust dependencies for known vulnerabilities by running cargo-audit against your project's Cargo.lock file. This scans your dependency tree for reported Rust CVEs and helps secure your supply chain before publishing.

Enforce license, crate ban, and source policies in Rust projects by configuring cargo-deny. This tool checks dependencies against your defined rules to ensure compliance and block unauthorized or risky crates.

Check memory safety in Rust FFI calls by applying safe Foreign Function Interface patterns and using Miri for soundness checks. This combination identifies undefined behavior and verifies safe memory handling across boundaries.

You can integrate fuzz testing into your Rust CI/CD pipeline to discover security bugs. By adding fuzzing alongside dependency auditing and policy enforcement, you achieve comprehensive security reviews during development.

Yes, cargo-deny works with cargo-audit to enhance Rust supply chain security. While cargo-audit detects known CVEs in dependencies, cargo-deny enforces broader rules for licenses, banned crates, and allowed sources.

You need Miri for Rust soundness checks because the compiler does not catch all unsafe code issues or FFI undefined behavior. Miri executes your code to detect memory safety flaws that standard compiler checks miss.