cargo-audit review
A focused open-source CLI for RustSec checks, reports, and dependency review.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
cargo-audit is an open-source command-line tool for Rust developers and security teams reviewing Cargo dependencies. It audits Cargo.lock files against the RustSec Advisory Database, reports known Rust crate vulnerabilities, and shows related dependency information. The tool runs locally as a Cargo subcommand on Linux and macOS, making it suited to teams that want self-hosted dependency checks rather than a hosted service.
Its strongest capability is focused Rust dependency auditing. Results can appear in terminal, JSON, or SARIF formats, while dependency trees help connect advisories to the packages that bring them into a project. cargo-audit can also check for yanked crates in Cargo.lock and scan compiled binaries through its bin subcommand when dependency metadata is embedded. Advisory ignore rules and audit.toml configuration provide control over how checks are applied. An experimental cargo audit fix command can update vulnerable dependency requirements, but teams should treat that as an optional remediation aid rather than a complete dependency update workflow.
The open-source pricing model suits teams that can incorporate a command-line tool into their own development and CI processes. Integrations include RustSec Advisory Database, cargo-auditable, GitHub Actions through rust-audit-check, and Travis CI. Its scope is intentionally narrow: it supports Rust / Cargo, does not generate SBOMs, does not perform reachability analysis, and does not provide native pull-request scanning. Rust teams seeking advisory checks, dependency context, and machine-readable reports should consider cargo-audit; organizations needing broader multi-ecosystem analysis or those capabilities should choose a different tool.
cargo-audit pros and cons
- Where it wins
- Checks Cargo.lock against the RustSec Advisory Database
- Supports terminal, JSON, and SARIF reports with dependency trees
- Scans compiled binaries and supports advisory ignore rules
- Where it doesn't
- Supports only the Rust / Cargo ecosystem
- Does not generate SBOMs or perform reachability analysis
- Does not provide native pull-request scanning
cargo-audit fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update