Rust still benefits from SAST, but the target is different. Safe Rust rules out many memory errors at compile time, so static analysis focuses on unsafe blocks, logic and input handling flaws, secrets, and the crates you depend on, since Rust projects usually import many.
What the language already handles
The compiler enforces ownership and borrowing in safe code, which prevents many use after free and data race bugs. That does not make a program secure. Authorization mistakes, injection into queries and commands, weak crypto choices and exposed secrets compile fine. See Rust ownership rules and the bugs they prevent and what unsafe turns off.
What to scan for
| Concern | Approach |
|---|---|
| Unsafe blocks | List and review each one, especially at FFI boundaries |
| Logic and input handling | Static analysis rules and code review |
| Secrets in code | Secret scanning |
| Vulnerable crates | Audit the lockfile against the advisory database |
| Untrusted build scripts | Review build.rs in new dependencies |
The rust-secure-code organization runs a project, safety-dance, to audit widely used crates for unsafe code that can be safely replaced and to file bugs or advisories where problems turn up. It shows the community treats unsafe as the place to look.
Dependency auditing
The cargo-audit tool checks a project's dependencies for crates with known vulnerabilities using the RustSec Advisory Database. It reads Cargo.lock. A few details matter:
- If no lockfile exists, it runs a workspace update to create one, and Cargo can execute code from the project, so only do that on trusted projects.
- For untrusted projects, pass the lockfile directly and run from outside the project directory.
- You can ignore a specific advisory by ID, which should always carry a recorded reason.
- It can also scan compiled binaries.
Steps
- Count and review unsafe blocks, and add a comment justifying each.
- Run dependency auditing on the lockfile in CI.
- Add secret scanning and a general SAST pass for input handling.
- Review build scripts when adding a new crate.
- Commit the lockfile for binaries so scans match what you ship.
How Safeguard helps
Safeguard covers SBOM and dependency scanning, reachability analysis, and policies and gates that apply in pull requests. The free scan is a quick way to see your dependency findings.
Quick check
Is Rust code free of vulnerabilities?
No. Safe Rust prevents many memory bugs, but logic flaws, unsafe blocks and vulnerable crates remain.
Is cargo audit a SAST tool?
No. It checks dependencies against advisories, which is software composition analysis.
Sources
- RustSec cargo-audit README (fetched 19 October 2026).
- rust-secure-code safety-dance repository (fetched 19 October 2026).
Last reviewed: 19 October 2026.
