cargo-vet
Shares rank 5 of 10 vulnerability scanners by recommenders
Recommended for auditing Rust crate dependencies for supply chain security; people say it is actively maintained by Google and Mozilla and has audits for most popular crates.
Recommended for auditing Rust crate dependencies for supply chain security; people say it is actively maintained by Google and Mozilla and has audits for most popular crates.
8 people gave an opinion
- recommend it
- 8
- criticize it
- 0
- approval share
- 100%
Recommended in 5 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 8 people recommend itNeeds 10 or more, not met.
- Nobody criticizes itNeeds 2 to 1 or better, met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Strengthens supply chain security
“Things like cargo-vet help as does enforcing non-token auth, scanning and required cooldown periods.”
Comment from 24 Nov 2025 in “Shai-Hulud Returns: Over 300 NPM Packages Infected” “Supply chain attacks are a real concern. Something like cargo vet could help.”
Comment from 11 Nov 2025 in “Debian Mandates Rust for Apt, Reshaping Ubuntu and Other Linux Distros” “Supply chain story is pretty solid with cargo-vet.”
Comment from 2 Aug 2026 in “(Rust) All-Hands 2026 Retrospective” Backed by Mozilla and Google
“cargo-vet would be a nice addition. It's Mozilla's tool for auditing crate dependencies”
Comment from 9 Feb 2026 in “Show HN: Sklad – Secure, offline-first snippet manager (Rust, Tauri v2)” “it exists for Rust and is actively maintained by Google, Mozilla, and many others”
Comment from 18 Feb 2026 in “Zero-day CSS: CVE-2026-2441 exists in the wild” “cargo-vet exists and is actively maintained by Google, Mozilla, and others”
Comment from 18 Feb 2026 in “Zero-day CSS: CVE-2026-2441 exists in the wild” Audits exist for popular crates
“Overall the number of audited crates is in the thousands and you will find audits for most of the popular crates.”
Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload” “basically a best-in-class distributed auditing system”
Comment from 16 Jun 2026 in “Memory safety CVEs differ between Rust and C/C++”
Other vulnerability scanners people recommend
The four most recommended other vulnerability scanners, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OpenAI Codex Security | 21 | 30 | 41% | 4 | — | — |
| govulncheck | 13 | 0 | 100% | 9 | — | Approved |
| AISLE | 11 | 2 | 85% | 5 | — | Approved |
| Trivy | 10 | 23 | 30% | 5 | — | — |
| cargo-vetThis page | 8 | 0 | 100% | 5 | — | — |
What people said
All 12 comments that mention it, newest first. Each links to the original comment.
“Overall the number of audited crates is in the thousands and you will find audits for most of the popular crates.”
“Audit build scripts/proc macros for rust code (and mark with cargo-vet).”
“Supply chain story is pretty solid with cargo-vet.”
“Tools like `cargo vet` and `cargo audit` seem to be pretty good.”
“EDIT: just saw reference to cargo-vet, very cool!”
“Ignore this and just use cargo-vet, you're welcome.”
“basically a best-in-class distributed auditing system”
“it exists for Rust and is actively maintained by Google, Mozilla, and many others”
“cargo-vet exists and is actively maintained by Google, Mozilla, and others”
“cargo-vet would be a nice addition. It's Mozilla's tool for auditing crate dependencies”
“Things like cargo-vet help as does enforcing non-token auth, scanning and required cooldown periods.”
“Supply chain attacks are a real concern. Something like cargo vet could help.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.