Yes. cargo audit bin followed by the file path checks compiled binaries against the RustSec database. Results are fully accurate only for binaries built with cargo auditable, which embeds the dependency list. For other binaries the tool recovers part of the list from panic messages, so it misses C code and about half of the Rust dependencies.
Why binaries matter
Lockfile scanning covers what you build. But you also receive binaries: a tool downloaded from a release page, a vendor executable, an old artifact in a registry. You may not have the source or the lockfile. Binary scanning is the fallback.
Two cases
| Binary type | What cargo audit can see |
|---|---|
| Built with cargo auditable | The embedded dependency list, giving fully accurate results |
| Built normally | A partial list recovered from panic messages, missing C code and about half of the Rust dependencies |
The project documentation states those limits directly, so treat a clean result on a normally built binary as weak evidence, not a clearance.
Steps for your own releases
- Build release artifacts with the auditable wrapper so the dependency data is embedded.
- Run the binary check on the produced file in CI, not only the lockfile check.
- Store the result next to the artifact.
- Re-scan old releases when new advisories appear, because the binary has not changed but the database has.
- Keep your SBOM alongside, so you have a second source of truth.
Steps for binaries you receive
- Record where it came from and the version.
- Run the binary check and note it was a partial recovery if the file was not built with embedded data.
- Ask the supplier for an SBOM. A scan result cannot replace a real component list.
- Treat any finding as a prompt to ask, not a final verdict.
Why a re-scan matters
An advisory published next month can apply to a binary you shipped last year. Without a way to re-check old artifacts, you will not know. Keep the inventory of shipped versions and schedule a periodic re-scan.
Related safety note
The project README says that if a lockfile is missing, the tool may generate one by running an update, which can execute project code. For untrusted projects, pass the lockfile explicitly and run from outside the project directory.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how components are found inside a built artifact rather than from source.
Quick check
Is a clean binary scan proof of safety?
No. For a normal build it sees only part of the dependencies, and it only knows published advisories.
Do I need the source to scan a binary?
No, but the more embedded data the binary has, the better the result.
Safeguard SBOM and dependency scanning can inventory what you ship, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
