rust_secure_dependency_audit

Audit the dependencies of a Rust project for maintenance risk, license compliance, and supply-chain health — usable both as a library and as a secure-audit CLI for CI pipelines.

It is intentionally complementary to cargo-audit (CVE scanning) and cargo-deny (advisories / bans): this crate focuses on how healthy your dependencies are, not just whether they currently have a published advisory.

What it tells you

For every dependency in your Cargo.lock, the audit produces:

You get a CLI summary, a JSON/Markdown report, and CI-friendly exit codes.

Installation

As a CLI

cargo install rust_secure_dependency_audit

This installs the secure-audit binary.

As a library

[dependencies]
rust_secure_dependency_audit = "0.2"
tokio = { version = "1", features = ["macros", "rt-multi-thread"] }

Quick start

CLI

# Audit the current directory and print a summary
secure-audit scan

# Show per-dependency detail
secure-audit scan --detailed

# Write a JSON report for downstream tooling
secure-audit report --format json --output audit.json

# CI gate: fail the build if anything scores below 60
secure-audit check --min-health-score 60 --fail-on-copyleft

# Skip dependencies you don't want to score (repeatable)
secure-audit scan --ignore some-build-tool --ignore another-dev-only-dep

Tip: export GITHUB_TOKEN (and optionally GITLAB_TOKEN) before running to raise API rate limits. Without a token, GitHub allows only 60 requests/hour, which is not enough for medium-sized projects.

Library

use rust_secure_dependency_audit::{audit_project, AuditConfig, HealthStatus};
use std::path::Path;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let config = AuditConfig::default();
    let report = audit_project(Path::new("."), &config).await?;

    for dep in &report.dependencies {
        if matches!(dep.status, HealthStatus::Risky | HealthStatus::Stale) {
            eprintln!("⚠  {} v{} — score {}", dep.name, dep.version, dep.health_score);
        }
    }

    Ok(())
}

See examples/basic_usage.rs and examples/custom_config.rs for more.

CLI reference

secure-audit accepts these global options (usable with any subcommand):

Subcommands

scan

Run an audit and print a colourised summary.

report

Generate a report file.

check

CI gate. Exits with code 1 if any check fails.

How scoring works

Each dependency gets a 0–100 health score, a weighted average of five component scores. The defaults sum to 1.0:

The score then maps to a status:

Yanked crates are capped at 10 regardless of any other signal.

License risk buckets

Licences are normalised through SPDX and bucketed:

• Permissive — MIT, Apache, BSD, ISC, Zlib, Unlicense, …
• Copyleft — GPL, LGPL, AGPL, MPL, EUPL, OSL, EPL, CDDL, CC-BY-SA
• Proprietary — anything matching "proprietary", "commercial", "all rights reserved"
• Unknown — missing or unrecognised expressions

Footprint risk (0.0 – 1.0)

Useful for embedded, mobile, or WASM targets where binary size matters. Calculated from:

• transitive dependency count (40%)
• feature count (30%)
• build-script dependency count (30%)

Configuration

Pass a TOML config file with --config. All keys are optional — anything you omit falls back to defaults.

[scoring_weights]
recency     = 0.35
maintenance = 0.25
community   = 0.15
stability   = 0.10
security    = 0.15

[staleness_thresholds]
stale_days      = 180   # >180 days idle → "stale"
risky_days      = 365   # >365 days idle → "risky"
min_maintainers = 2

[license_policy]
allowed_licenses   = ["MIT", "Apache-2.0", "BSD-3-Clause"]
forbidden_licenses = ["AGPL-3.0"]
warn_on_copyleft   = true
warn_on_unknown    = true

[footprint_thresholds]
max_transitive_deps = 50
max_footprint_risk  = 0.7

[network]
timeout_secs     = 30
max_retries      = 3
request_delay_ms = 100
enable_openssf   = true

Then:

secure-audit scan --config audit-config.toml

If scoring_weights doesn't sum to exactly 1.0, call ScoringWeights::validate() from the library to surface the error, or ScoringWeights::normalize() to rescale.

Environment variables

Caveats

• Network required. Scoring relies on crates.io, GitHub, GitLab, and OpenSSF APIs. Air-gapped environments aren't supported.
• Heuristics, not audits. A high score means signals look healthy, not that the code is secure. Pair this tool with cargo-audit and manual review for anything critical.
• Rate limits. Set GITHUB_TOKEN for non-trivial projects.

Contributing

PRs welcome. Areas where help is especially useful:

• Additional heuristics (e.g. release cadence, breaking-change frequency)
• More Git platforms (Gitea, Codeberg, sourcehut)
• Local caching of API responses
• Integration with cargo-audit / cargo-deny advisory data

Please open an issue first for non-trivial changes: https://github.com/emorilebo/rust_secure_dependency_audit/issues

License

Dual-licensed under either of

• MIT — LICENSE-MIT or https://opensource.org/licenses/MIT
• Apache 2.0 — LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0

at your option. Contributions are accepted under the same dual licence unless you explicitly state otherwise.