cargo-audit

What it does

Advisory data exchange

RustSec exports advisory data to OSV in real time, and its data is imported by the GitHub Advisory Database.checked 11 Oct 2026

Advisory handling

Advisories can be ignored with the `--ignore` option or configured in audit.toml.checked 11 Oct 2026

Binary scanning

The `cargo audit bin` subcommand scans compiled binaries; results are fully accurate when binaries include dependency data from cargo-auditable.checked 11 Oct 2026

Binary scanning limit

For binaries not built with cargo-auditable, dependency recovery from panic messages misses embedded C code and roughly half of Rust dependencies.checked 11 Oct 2026

CI integration

The README recommends the audit-check GitHub Action for using cargo-audit on GitHub Actions.checked 11 Oct 2026

Fix command

An experimental `cargo audit fix` feature can update vulnerable dependency requirements in Cargo.toml and supports a dry run.checked 11 Oct 2026

Installation

Install it as a Cargo subcommand with `cargo install cargo-audit`.checked 11 Oct 2026

License

The cargo-audit crates are licensed under either Apache License 2.0 or MIT, at the user's option.checked 11 Oct 2026

Maintainer

The RustSec Advisory Database is maintained by the Rust Secure Code Working Group.checked 11 Oct 2026

Purpose

Audits Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database.checked 11 Oct 2026

Requirements

cargo-audit requires Rust 1.74 or later.checked 11 Oct 2026

Security scope

The RustSec Advisory Database contains security advisories filed against Rust crates published via crates.io.checked 11 Oct 2026

Usage caution

The README advises running cargo-audit only on trusted projects because generating a missing Cargo.lock runs cargo update --workspace and Cargo may execute project code.checked 11 Oct 2026