Skip to content
SPECIFICTION
Get listed

cargo-audit

rustsec.org

Free plan macOSLinux
Visit rustsec.org
Spec score 7.9 #25 of 65 in Software Composition Analysis Software

Spec sheet

Purpose
Audits Cargo.lock files for crates with security vulnerabilities reported to the RustSec Advisory Database.Read 11 Oct 2026 · rustsec.org
License
The cargo-audit crates are licensed under either Apache License 2.0 or MIT, at the user's option.Read 11 Oct 2026 · github.com
Advisory data exchange
RustSec exports advisory data to OSV in real time, and its data is imported by the GitHub Advisory Database.Read 11 Oct 2026 · rustsec.org
Advisory handling
Advisories can be ignored with the `--ignore` option or configured in audit.toml.Read 11 Oct 2026 · github.com
Binary scanning
The `cargo audit bin` subcommand scans compiled binaries; results are fully accurate when binaries include dependency data from cargo-auditable.Read 11 Oct 2026 · github.com
Binary scanning limit
For binaries not built with cargo-auditable, dependency recovery from panic messages misses embedded C code and roughly half of Rust dependencies.Read 11 Oct 2026 · github.com
CI integration
The README recommends the audit-check GitHub Action for using cargo-audit on GitHub Actions.Read 11 Oct 2026 · github.com
Fix command
An experimental `cargo audit fix` feature can update vulnerable dependency requirements in Cargo.toml and supports a dry run.Read 11 Oct 2026 · github.com
Installation
Install it as a Cargo subcommand with `cargo install cargo-audit`.Read 11 Oct 2026 · github.com
Maintainer
The RustSec Advisory Database is maintained by the Rust Secure Code Working Group.Read 11 Oct 2026 · rustsec.org
Requirements
cargo-audit requires Rust 1.74 or later.Read 11 Oct 2026 · github.com
Security scope
The RustSec Advisory Database contains security advisories filed against Rust crates published via crates.io.Read 11 Oct 2026 · rustsec.org
Usage caution
The README advises running cargo-audit only on trusted projects because generating a missing Cargo.lock runs cargo update --workspace and Cargo may execute project code.Read 11 Oct 2026 · github.com

Plans and prices

cargo-audit Free Open-source Cargo subcommand · Requires Rust 1.74 or later Read 11 Oct 2026 · github.com

Every cargo-audit plan and price →

Where Specifiction places it

Alternatives to cargo-auditAll alternatives →