Set unknown-registry and unknown-git to deny in the [sources] table of deny.toml, then list approved locations in allow-registry and allow-git. Run cargo deny check sources in CI. Any crate from somewhere else fails the build until someone approves it in review.
Why sources matter
A crate name on a registry is only part of its identity. The same name can resolve to a different place: a private registry, a fork on a git host, or a branch that moves. If a pull request quietly swaps a registry dependency for a git dependency, your usual advisory checks may never see it, because there is no registry release to match.
The sources check gives you a simple rule: every crate must come from a place you named in advance.
The keys and their defaults
| Key | Default | What it does |
|---|---|---|
unknown-registry | warn | Action for crates from registries not in the allow list |
unknown-git | warn | Action for crates from git repos not in the allow list |
allow-registry | the crates.io index | List of registry URLs you accept |
allow-git | none listed | List of git repo URLs you accept |
The values for the two action keys are deny, warn and allow. Deny fails the check, warn prints a warning, and allow prints a note. Setting allow-registry to an empty list allows no registry at all. Git URL matching is exact, though a trailing .git is ignored.
A strict starting config
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []
With this file, every git dependency fails. If you genuinely need one, add its exact URL to allow-git in a pull request that someone else reviews. That review is the control.
Rollout steps
- Run
cargo deny check sourceswith the defaults and read the warnings. This tells you what you already depend on from outside the main registry. - For each git dependency, decide: replace it with a released version, pin it, or approve it.
- Add approved URLs to the allow lists.
- Flip the two action keys to deny.
- Make the check a required status on pull requests.
Pair it with pinning
Git dependencies are locked to a commit in Cargo.lock when added, and move only when you run cargo update, according to the Cargo reference. Even so, pin an explicit revision in Cargo.toml so the intent is visible in review, and keep the approved list short.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a failing policy check blocks a merge and what the author sees.
Quick check
Does this block a malicious crate from crates.io itself?
No. A crate from the approved registry passes the sources check. Use the advisories check, review and a vetting process for that risk.
What about a private registry?
Add its index URL to allow-registry. Keep the list as short as your real needs.
Safeguard policies and gates can block a pull request that adds an unreviewed dependency, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
