cargo-audit
Shares rank 5 of 10 vulnerability scanners by recommenders
Checks Rust crate dependencies against known vulnerability lists and flags when to update. Its most common caveat is that it only catches known issues, so it can be too late.
Checks Rust crate dependencies against known vulnerability lists and flags when to update. Its most common caveat is that it only catches known issues, so it can be too late.
11 people gave an opinion
- recommend it
- 8
- criticize it
- 3
- approval share
- 73%
Recommended in 5 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 8 people recommend itNeeds 10 or more, not met.
- 2.7 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Flags vulnerable dependencies and guides updates
“Tools like `cargo-audit` can tell you if a crate has security issues and guide you towards an update.”
Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload” “cargo-audit is the automated mechanism you are looking for”
Comment from 21 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload” “checks all dependencies against the CVEs”
Comment from 21 Oct 2026 in “Today's PHP security release, and how we're strengthening security” Useful combined with other Cargo tools
“In combination with cargo-audit, cargo-deny and co this is already quite useful”
Comment from 11 Apr 2026 in “Supply chain nightmare: How Rust will be attacked and what we can do to mitigate” “Tools like `cargo vet` and `cargo audit` seem to be pretty good.”
Comment from 5 Jul 2026 in “Zig: All Package Management Functionality Moved from Compiler to Build System”
What people warn about
Each mark is one comment
Only catches known issues, often late
“cargo audit is an attempt to fix this retrospectively”
Comment from 7 Jul 2026 in “Zig: All Package Management Functionality Moved from Compiler to Build System” “cargo audit can only search for known issues, as such is like a virus scanner, often being too late”
Comment from 8 Jul 2026 in “Zig: All Package Management Functionality Moved from Compiler to Build System”
Other vulnerability scanners people recommend
The four most recommended other vulnerability scanners, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OpenAI Codex Security | 21 | 30 | 41% | 4 | — | — |
| govulncheck | 13 | 0 | 100% | 9 | — | Approved |
| AISLE | 11 | 2 | 85% | 5 | — | Approved |
| Trivy | 10 | 23 | 30% | 5 | — | — |
| cargo-auditThis page | 8 | 3 | 73% | 5 | — | — |
What people said
10 of the 11 comments that mention it, newest first. Each links to the original comment.
“checks all dependencies against the CVEs”
“cargo-audit is the automated mechanism you are looking for”
“that is not nearly as universally installed as `find`”
“Tools like `cargo-audit` can tell you if a crate has security issues and guide you towards an update.”
“cargo audit can only search for known issues, as such is like a virus scanner, often being too late”
“cargo audit is an attempt to fix this retrospectively”
“Tools like `cargo vet` and `cargo audit` seem to be pretty good.”
“In combination with cargo-audit, cargo-deny and co this is already quite useful”
“since it relies on a Cargo.lock to be correct it also is affected by bugs that place dependencies in the Cargo.lock”
“it only tells you that you're using a version that was vulnerable, not that you're using a specific API that was vulnerable”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.