cargo vet is a tool that records which third party crates a person or organization has audited, stores that record in your repository, and fails continuous integration when new unaudited code appears. Existing dependencies start on an exemptions list so you can adopt it without auditing everything first.
How it differs from an advisory scanner
An advisory scanner asks whether a crate matches a known vulnerability. cargo vet asks whether anyone you trust has looked at this code. They answer different questions, and the second covers brand new malicious code that no advisory lists yet.
The pieces
| Piece | What it is |
|---|---|
| Init | cargo vet init creates metadata in your repo |
| Exemptions | Existing third party dependencies listed as not yet audited |
| Audits | Records stored in the tree, submitted with the change that adds the code |
| Imports | Audit files from other organizations you choose to trust |
| Criteria | The standard an audit certifies, with custom criteria as an advanced option |
| Policies | Settings for different parts of the build graph |
Audits live in the repository, so developers do not authenticate to an external system. CI analyzes the build graph and refuses a change if new third party code lacks an audit from a trusted source.
Imports without a central service
When a crate is not covered, the tool can search the registry for audits from well known organizations and offer to add one as a trusted import. Imports point straight at audit files in external repositories. The registry is only an index of those files, so there is no central service to compromise, according to the project's description.
Diff audits
If someone has audited another version of a crate, cargo vet computes diffs and finds the smallest one for you to review. That makes updating realistic: you read what changed, not the whole crate. It works for exempted crates too.
A rollout
- Initialise in a branch and commit the generated directory.
- Leave everything on the exemptions list and make CI run the check.
- Decide who owns the directory. Approval of imports and audits falls to its code owners, which should be project leadership or a security team.
- Choose which outside audit sources to trust, and write down why.
- Audit new dependencies as they are added, and burn down exemptions by risk, starting with crates that run build scripts or handle untrusted input.
Honest limits
An audit is a human judgement at one point in time. It does not guarantee a crate is free of bugs. Trusting an imported audit is trusting that organization's criteria, so read them. And the effort is real: expect audits to be a regular engineering task, not a one time setup.
Quick check
Does cargo vet replace cargo deny?
No. They solve different problems. One tracks human review, the other enforces advisory, license, ban and source policy.
Do I have to audit all my dependencies on day one?
No. Existing ones go on the exemptions list and you work through them over time.
Safeguard SBOM and dependency scanning and policies can sit alongside review processes like this, and a free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
