Auditing Rust Crates Effectively
summary
Cargo Scan is an interactive analysis tool that inspects Rust crates, models side-effecting APIs, and propagates color-checked propagation across call sites so audits only inspect effectful code paths. Implemented as a VS Code extension, it conservatively marks public functions, imports those markers into parent crates, and can default to marking all effects as color-checked. Evaluation finds over 85% of top-1,000 crates safe, a median 13.2% of lines to audit in hyper’s tree, and flags 14/16 known vulnerable locations.
AI-written summary · about
chapters (9)
- 0:00cargo-scan intro
- 6:49Interactive auditing in cargo-scan
- 10:44Reducing audit effort
- 11:49Color-checked effects frequency
- 12:53Detecting real vulnerabilities
- 14:15cargo-scan future
- 15:02Cubist and cargo-vet feedback
- 16:31Handling crate updates
- 17:12Limitations and vulnerabilities
related talks
35mAn intro to the world of auditing Rust code
50mCrate security in 2025
45mRust
45mBuilding Safe and Secure Systems in Rust
25m“Dude, Where's My C?"
01h 01mClosing the Gap between Rust and C++ Using Principles of Static Analysis
30mWhy We Need to Adopt Static Analysis in Dependency Tools
20mDependency Analytics