# Dependency audit
Reviewed 2026-08-02 for `kcode-kennedy-roots` 0.1.0.
This library receives Kennedy's reusable Kweb signing configuration while it
opens the database and creates canonical roots. `kcode-kweb-db =1.0.4` is
therefore exact-pinned. The library forbids unsafe code, does not log or persist
the signing key outside Kweb's owner, does not expose the live database, and
hands the sole handle directly to `kcode-kweb-manager` after bootstrap.
SQLite is used only for the existing identity database and the two-row
`kmap_system_roots` directory. SQL statements are fixed except for bound values.
Root mutations use typed Kweb Manager operations and fresh UUID idempotency IDs.
No network client, shell command, build script, procedural macro defined by this
crate, or alternate credential store is present.