{"slug": "cargo-audit", "name": "cargo audit", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 6, "warners": 1, "score": 2.315, "rising": 0.35, "first": "2026-01-06", "latest": "2026-10-21", "why": "For my rust applications, I use \"cargo audit\" which checks all dependencies against the CVEs.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 2, "compare": 0, "warn": 1}, "spark": [0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "For my rust applications, I use \"cargo audit\" which checks all dependencies against the CVEs.", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://rustsec.org/", "pricing": "", "aliases": ["cargo audit", "cargo-audit"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 802984224, "item_id": 50186514, "url": "https://news.ycombinator.com/item?id=50186514", "by": "berkes", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "For my rust applications, I use \"cargo audit\" which checks all dependencies against the CVEs.", "excerpt": "Several tech stacks have this built in or available. For my rust applications, I use \"cargo audit\" which checks all dependencies against the CVEs. For my typescript and javascript applications, deno audit and/or yarn npm audit. For the rest of the stack `debsecan` does exactly what you want on Ubuntu: report CVEs for installed software.", "context": "", "use_case": "Rust dependency CVE checking", "switched_from": "", "story": "Today's PHP security release, and how we're strengthening security"}, {"id": 763521105, "item_id": 47720069, "url": "https://news.ycombinator.com/item?id=47720069", "by": "QuantumNomad_", "date": "2026-04-10", "version": null, "stance": "recommend", "quote": "which uses the RustSec advisory DB https://rustsec.org/", "excerpt": "> full of unpatched security issues If you host your own internal crates.io mirror, I see two ways to stay on top of security issues that have been fixed upstream. Both involving the use of cargo audit which uses the RustSec advisory DB https://rustsec.org/ Alternative A) would be to redirect the DNS for crates.io in your company internal DNS server to point at your own mirror, and to have your company servers and la", "context": "", "use_case": "", "switched_from": "", "story": "Supply chain nightmare: How Rust will be attacked and what we can do to mitigate"}, {"id": 744186848, "item_id": 46511678, "url": "https://news.ycombinator.com/item?id=46511678", "by": "goku12", "date": "2026-01-06", "version": null, "stance": "recommend", "quote": "Rust has tools that can use the data from rustsec to do the audit (cargo-audit).", "excerpt": "> How do you do that practically? Do you read the source of every single package before doing a `brew update` or `npm update`? There are several ways to do this. What you mentioned is the brute-force method of security audits. That may be impractical as you allude to. Perhaps there are tools designed to catch security bugs in the source code. While they will never be perfect, these tools should significantly reduce t", "context": "", "use_case": "", "switched_from": "", "story": "Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 781381697, "item_id": 48836356, "url": "https://news.ycombinator.com/item?id=48836356", "by": "uecker", "date": "2026-07-08", "version": null, "stance": "warn", "quote": "cargo audit can only search for known issues", "excerpt": "I do not keep track of them, but google finds CrateDepression, faster_log, async_println, finch-rust or recently: https://cybersecuritynews.com/supply-chain-trapdoor-malware/ It is not FUD as it is a real risk. cargo audit can only search for known issues, as such is like a virus scanner, often being too late. \"You have to vet your dependencies no matter what\" sounds nice, but Rust packages tend to pull in many hundr", "context": "", "use_case": "", "switched_from": "", "story": "Zig: All Package Management Functionality Moved from Compiler to Build System"}]}], "who": [], "tags": [], "use_cases": ["rust dependency cve checking", "dependency vulnerability audit"], "compared": [{"slug": "cargo", "name": "Cargo", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50182987", "title": "Today's PHP security release, and how we're strengthening security", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49374269", "title": "Malicious Rust Crate Arrayref Runs a Build-Time Payload", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48786638", "title": "Zig: All Package Management Functionality Moved from Compiler to Build System", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47718891", "title": "Supply chain nightmare: How Rust will be attacked and what we can do to mitigate", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47222270", "title": "Go is the best language for agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46501894", "title": "Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {}, "2026-03": {"neutral": 1}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {"warn": 1}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {"recommend": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 802984224, "item_id": 50186514, "url": "https://news.ycombinator.com/item?id=50186514", "by": "berkes", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "For my rust applications, I use \"cargo audit\" which checks all dependencies against the CVEs.", "excerpt": "Several tech stacks have this built in or available. For my rust applications, I use \"cargo audit\" which checks all dependencies against the CVEs. For my typescript and javascript applications, deno audit and/or yarn npm audit. For the rest of the stack `debsecan` does exactly what you want on Ubuntu: report CVEs for installed software.", "context": "", "use_case": "Rust dependency CVE checking", "switched_from": "", "story": "Today's PHP security release, and how we're strengthening security"}, {"id": 790025696, "item_id": 49376606, "url": "https://news.ycombinator.com/item?id=49376606", "by": "cube00", "date": "2026-08-20", "version": null, "stance": "neutral", "quote": "`cargo audit` should be reporting if these packages have been downloaded.", "excerpt": "> They're definitely not unprepared for an incident like this. We shouldn't need to resort to pasting `find` commands [1] into the shell from blog posts to tell if we're compromised. `cargo audit` should be reporting if these packages have been downloaded. The \"What you need to do\" section of the blog should be run `cargo audit` > Not having an advisory INSTANTLY available isn't a sign of a decaying org. Chill. The G", "context": "", "use_case": "Dependency vulnerability audit", "switched_from": "", "story": "Malicious Rust Crate Arrayref Runs a Build-Time Payload"}, {"id": 781381697, "item_id": 48836356, "url": "https://news.ycombinator.com/item?id=48836356", "by": "uecker", "date": "2026-07-08", "version": null, "stance": "warn", "quote": "cargo audit can only search for known issues", "excerpt": "I do not keep track of them, but google finds CrateDepression, faster_log, async_println, finch-rust or recently: https://cybersecuritynews.com/supply-chain-trapdoor-malware/ It is not FUD as it is a real risk. cargo audit can only search for known issues, as such is like a virus scanner, often being too late. \"You have to vet your dependencies no matter what\" sounds nice, but Rust packages tend to pull in many hundr", "context": "", "use_case": "", "switched_from": "", "story": "Zig: All Package Management Functionality Moved from Compiler to Build System"}, {"id": 763521105, "item_id": 47720069, "url": "https://news.ycombinator.com/item?id=47720069", "by": "QuantumNomad_", "date": "2026-04-10", "version": null, "stance": "recommend", "quote": "which uses the RustSec advisory DB https://rustsec.org/", "excerpt": "> full of unpatched security issues If you host your own internal crates.io mirror, I see two ways to stay on top of security issues that have been fixed upstream. Both involving the use of cargo audit which uses the RustSec advisory DB https://rustsec.org/ Alternative A) would be to redirect the DNS for crates.io in your company internal DNS server to point at your own mirror, and to have your company servers and la", "context": "", "use_case": "", "switched_from": "", "story": "Supply chain nightmare: How Rust will be attacked and what we can do to mitigate"}, {"id": 755559872, "item_id": 47222492, "url": "https://news.ycombinator.com/item?id=47222492", "by": "linolevan", "date": "2026-03-02", "version": null, "stance": "neutral", "quote": "Not understanding the difference between this and something like cargo audit", "excerpt": "Not understanding the difference between this and something like cargo audit[0]. I suppose it has something to do with \"static analysis of vulnerabilities\" but I don't see any of that from a quick google search of govulncheck. [0]https://crates.io/crates/cargo-audit", "context": "", "use_case": "", "switched_from": "", "story": "Go is the best language for agents"}, {"id": 744186848, "item_id": 46511678, "url": "https://news.ycombinator.com/item?id=46511678", "by": "goku12", "date": "2026-01-06", "version": null, "stance": "recommend", "quote": "Rust has tools that can use the data from rustsec to do the audit (cargo-audit).", "excerpt": "> How do you do that practically? Do you read the source of every single package before doing a `brew update` or `npm update`? There are several ways to do this. What you mentioned is the brute-force method of security audits. That may be impractical as you allude to. Perhaps there are tools designed to catch security bugs in the source code. While they will never be perfect, these tools should significantly reduce t", "context": "", "use_case": "", "switched_from": "", "story": "Brave overhauled its Rust adblock engine with FlatBuffers, cutting memory 75%"}]}