CARGO-AUDIT TRIAGE · RUNS IN YOUR BROWSER

Which cargo audit findings does your Rust code actually use?

cargo audit prints every RustSec advisory that matches your Cargo.lock with no way to tell the crate your service calls from the one a build tool dragged in. Paste the cargo audit --json output and your Rust source: findings are ranked by whether the flagged crate is used by your runtime code, test/bench/build-script only, or not referenced. Paid platforms (Snyk, Endor Labs) sell reachability analysis; this is the free, offline first pass.

Nothing is uploaded. What you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own. It is a static text scan and a heuristic ranking, not a security audit.

1. Paste cargo audit --json

2. Paste your source (optional but it is the point)

Concatenate files, or put a line // file: src/main.rs before each so test files are recognised. In the CLI the directory is scanned for you.

Paste the audit output above and click Triage.

Want it as a CI gate?

Same logic, zero dependencies. It reads the audit file and walks your source directory, nothing else:

cargo audit --json | node cargo-audit-triage.mjs - src          # triage, print ranked list
cargo audit --json | node cargo-audit-triage.mjs - src --fail-on-imported   # exit 1 if a runtime-used crate has a vulnerability
node cargo-audit-triage.mjs audit.json src lib --json         # machine-readable

Get cargo-audit-triage.mjs and triage.mjs from the repo. Run cargo audit yourself first; this tool only reads its output. Node 18+, nothing to install, no network calls.

Common questions

Why does cargo audit report vulnerabilities in crates I barely use?

cargo audit matches every crate in Cargo.lock against the RustSec advisory database. It does not look at your code, so it cannot tell a crate your service calls on every request from a transitive dependency of a build tool. It also mixes vulnerabilities with unmaintained, unsound and yanked warnings, so a long list has no obvious order. This tool adds one signal, whether your Rust source uses the crate, so you read the reachable findings first.

How does the triage decide a crate is reachable?

It scans .rs source as text for use declarations (including brace groups), extern crate and crate::path expressions, maps dashes in crate names to underscores (serde-json is used as serde_json) and compares them to the audit. A flagged crate named from src/ ranks first, one named only from tests, benches, examples or build.rs ranks next, and one never named ranks last. Real vulnerabilities rank above unmaintained or yanked warnings. It is a static text scan and cannot see macro-generated paths, renamed dependencies or feature-gated code.

Does this mean the low-ranked advisories are safe to ignore?

No. Not used is not the same as not exploitable: a crate can be compiled in through another crate you do use, and a build script runs at build time. The ranking tells you where to look first, not what to skip forever. Keep patching on a schedule.

Does this tool upload my audit output or source code?

No. Everything you paste is processed in this page and never leaves your device, and the page makes no network calls. The CLI reads the audit file and the source directory you name and nothing else.

Is this security advice?

No. It is a heuristic ranking of publicly reported advisories using a text scan of your code. It is not a security audit, penetration test or guarantee, and it can miss reachable vulnerabilities.

More: how to triage cargo audit findings without ignoring real risk