# Dependency audit
Reviewed 2026-08-02 for `kcode-kennedy-app` 0.1.0.
This crate is the security-sensitive composition root and directly handles the
credential-vault passphrase, OpenAI and Gemini API keys, the Telegram bot token,
the crates.io publication token, and Kweb signing configuration. Its source was
reviewed for secret exposure, persistence ordering, maintenance exclusion, and
capability wiring. Secrets are read only from `kcode-credential-vault`, are not
logged or placed in command arguments, and are passed only to their intended
typed constructors. Temporary plaintext prompt values use zeroizing wrappers.
Direct credential-bearing dependencies are exact-pinned:
- `kcode-credential-vault =0.1.0` owns encrypted vault persistence.
- `kcode-intelligence-router =0.2.3` receives OpenAI and Gemini credentials.
- `kcode-dev-tools =0.4.3` receives the crates.io publication token.
- `kcode-tg-kennedy-bot =0.5.1` receives the Telegram bot token.
- `kcode-telegram-identity =0.1.5` owns durable authorization identity state.
- `kcode-kennedy-roots =0.1.0` receives Kweb signing configuration during
bootstrap and is separately audited.
The downstream executable exact-pins `kcode-kennedy-app =0.1.0`. Ordinary
capability, routing, formatting, and runtime dependencies remain compatible
SemVer requirements as required by project policy. Default features are avoided
for Rustls; the app installs the reviewed Ring provider explicitly.
No build script, procedural macro, unsafe block, network client, shell command,
or filesystem discovery is introduced by this crate itself. Network and durable
operations occur only through the named typed service owners constructed in
`main`.