Core Code
Core Code Modern Dev Handbook
RUST Contents
Rust Foundations for Production
Toolchain and Cargo Basics Project Layout Conventions Dependency Management Basics Configuration and Environment Basics Logging First Steps
Ownership, Borrowing, Lifetimes
Ownership Model Explained Borrowing Rules Lifetimes in Practice Smart Pointers: Box, Rc, Arc Interior Mutability
Types, Traits, and APIs
Traits and Generics Newtype Pattern API Design with Result and Option Serde Derive Basics Module Visibility Patterns
Error Handling & Reliability
Error Types with anyhow and thiserror Error Context and Chaining Retries and Timeouts Basics Idempotency Basics Input Validation Basics
Testing & Quality Gates
Unit and Integration Tests Mocking Strategies Coverage and Quality Gates CI Basics Contract Tests Basics
Concurrency & Shared State
Threads and Channels Mutex and RwLock Arc and Shared Ownership Deadlocks and Debugging Send and Sync Traits
Async Rust in Production
Async Runtime with Tokio Async Cancellation Async Timeouts Async Backpressure Basics Async Common Pitfalls
Web Services Basics
HTTP Server with Axum Routing and Middleware Basics JSON Errors and Problem Details Request IDs and Correlation Graceful Shutdown
Database & Migrations Basics
Choosing SQLx or Diesel Connection Pooling Migrations Basics Transactions Basics Query Timeouts
Observability Basics
Tracing Basics Metrics Basics Health Checks and Readiness Structured Logging Production Debugging Basics
Build, Release, Deployment Intro
Cross Compilation Basics Dockerizing Rust Services Configuration and Secrets Basics Release Profiles Rollback Strategies Basics
Security & Hardening Basics
Input Sanitization Deserialization Hardening SSRF and Egress Basics TLS Basics Dependency Vulnerability Scanning

Dependency Vulnerability Scanning

Continuously scan Rust dependencies for known vulnerabilities and treat the lockfile as a security boundary. Integrate cargo audit into CI and adopt a clear update policy to reduce supply chain risk.
On this page

Why dependency security is a production responsibility

Modern Rust services depend on dozens of crates, often indirectly. A single vulnerable transitive dependency can introduce security risk even if your own code is correct. Supply chain security means knowing what you ship, detecting known vulnerabilities early, and having a disciplined update process.

Production goals at this level

  • Visibility: know exactly which crate versions are in your build.
  • Continuous scanning: detect known vulnerabilities before deploy.
  • Lockfile discipline: treat Cargo.lock as part of your security boundary.
  • Defined update policy: avoid ad-hoc upgrades during incidents.

Cargo.lock is part of your artifact

For applications, Cargo.lock must be committed to version control. It pins exact dependency versions. Without it, builds can drift between environments, increasing unpredictability and risk.

Install cargo audit

cargo audit checks your dependency graph against the RustSec advisory database.

cargo install cargo-audit

Run a vulnerability scan

cargo audit

The tool analyzes Cargo.lock and reports known advisories affecting your dependency tree.

Interpreting audit output

Typical findings include:

  • Vulnerable crate version with advisory ID
  • Patched version recommendation
  • Indirect dependency path

Do not panic at every warning. Classify severity and exposure first.

Integrate into CI

Dependency scanning should not be manual. Add it to your CI pipeline so new vulnerabilities are detected automatically.

# Example CI step
cargo audit --deny warnings

At minimum, fail CI on high severity advisories. For moderate ones, require review.

Update strategy: controlled and measured

Blindly updating all crates can introduce regressions. Adopt a measured strategy:

  • Regular scheduled dependency review.
  • Patch updates first.
  • Minor updates with integration testing.
  • Major updates with careful review.

Use cargo update intentionally

# Update a specific crate
cargo update -p crate_name

# Update all dependencies
cargo update

After updates, run full test suite and measure performance if critical paths are affected.

Minimal SBOM mindset

Software Bill of Materials means knowing your dependency graph. Even without a full enterprise SBOM system, you can:

  • Keep Cargo.lock committed.
  • Archive build artifacts with version metadata.
  • Document Rust toolchain version.

Toolchain pinning

Pin Rust version to avoid unexpected compiler changes affecting your build.

# rust-toolchain.toml
[toolchain]
channel = "1.76.0"

Supply chain attack awareness

Security issues do not always come from known CVEs. Risks include:

  • Compromised crate maintainers.
  • Malicious typosquatting crates.
  • Unmaintained dependencies.

Prefer well-maintained crates with active communities and review dependency additions carefully.

Common mistakes

  • Ignoring Cargo.lock in applications.
  • Running cargo audit only after an incident.
  • Updating dependencies directly in production branches without testing.
  • Disabling CI failures for convenience.

Operational checklist

  • Cargo.lock committed and versioned.
  • cargo audit runs in CI.
  • Critical advisories block release.
  • Dependency updates follow a documented policy.
  • Rust toolchain version is pinned.

Security maturity mindset

Supply chain security is not about zero dependencies. It is about controlled risk. A disciplined update and scanning process reduces surprise exposure and keeps production predictable.

Section summary

In this section, you hardened input handling, tightened deserialization rules, restricted outbound network access, applied TLS correctly, and introduced dependency vulnerability scanning. Together, these practices form a minimal but production-ready security baseline for Rust services.