Rust for C-Programmers

23.13 Security Considerations

While Crates.io and Cargo provide a convenient way to share and use code, dependencies introduce potential security risks (supply chain attacks).

• Vet Dependencies: Before adding a new dependency, especially from less-known authors, check its source repository, download count, and community feedback if possible.
• Keep Dependencies Updated: Regularly update dependencies using cargo update to receive bug fixes and security patches. Use cargo outdated to identify crates needing updates.
• Audit Dependencies: Use tools like cargo audit (from the rustsec/cargo-audit crate) to check your Cargo.lock file against the RustSec Advisory Database for known vulnerabilities in your dependencies. Integrate this into your CI pipeline.

  cargo install cargo-audit
  cargo audit
  

• Minimize Dependencies: Avoid adding dependencies unnecessarily. Fewer dependencies mean a smaller attack surface. Review dependencies periodically and remove unused ones (cargo-machete can help find unused dependencies).