Cargo Audit

Cargo Audit Integration with DefectDojo

Cargo Audit is the standard dependency vulnerability scanner for Rust projects — purpose-built for the Cargo package ecosystem and backed by the RustSec Advisory Database, a community-maintained database of security advisories for Rust crates. For teams building with Rust, Cargo Audit provides fast, accurate scanning of Cargo.lock against known vulnerabilities, informational advisories, and unmaintained crate warnings with no external dependencies, no account registration, and no configuration required. Like all point-in-time scanners, Cargo Audit's value is limited by what happens after the scan runs. Without a vulnerability management platform, findings live in terminal output and CI logs — not tracked, not aged, not SLA-enforced, and not visible across your Rust portfolio. Integrating Cargo Audit with DefectDojo closes that gap, bringing Rust dependency findings into a persistent lifecycle with the full remediation workflow that an enterprise security program requires.

Why Cargo Audit Matters

Cargo Audit's role in Rust security programs reflects both the maturity of the Rust security ecosystem and the specific advantages of the language's package management model.

• Cargo Audit scans Cargo.lock against the RustSec Advisory Database, covering CVEs, RustSec-specific vulnerability identifiers (RUSTSEC-YYYY-NNNN), informational notices, and unmaintained crate warnings — giving teams visibility into security risk, active maintenance status, and known-unsafe usage patterns in a single scan
• Cargo.lock captures the complete, resolved dependency graph including all transitive crates — Cargo Audit scans the full dependency tree without any additional configuration, surface area that manifest-only scanning would miss
• Unmaintained crate detection is a distinctive capability: RustSec tracks crates whose authors have flagged them as no longer maintained, giving teams proactive signal about dependency risk before a CVE is published for an abandoned crate
• JSON output via --json produces structured data that DefectDojo can ingest directly, with advisory identifiers, affected version ranges, patched versions, and advisory URLs included in every finding record
• Cargo Audit runs against any Rust project with a Cargo.lock file with a single command — cargo audit — making it trivially easy to add to any CI pipeline
• The RustSec Advisory Database is updated continuously by the Rust security working group, and cargo audit fetches the latest database on each run, ensuring scan results reflect current advisory state without manual database update steps

Advantages of This Integration

Cargo Audit identifies vulnerable and unmaintained Rust crates in your dependency tree. DefectDojo tracks whether your team acted on them — and when.

• Persistent finding records across Rust scan cycles: Each time Cargo Audit runs against a project, reimporting into DefectDojo updates existing findings rather than generating a disconnected new record set. Crate CVEs that have been present across multiple scans are visible by age; findings resolved by a cargo update are automatically closed; findings open for 30 days without action are surfaced by SLA tracking — none of this is available from raw Cargo Audit output.
• SLA enforcement for Rust dependency vulnerabilities: DefectDojo applies configurable SLA policies by severity across all imported Cargo Audit findings. Critical and High severity advisories get remediation deadlines; unmaintained crate warnings get a longer review cadence. Breach tracking surfaces overdue items in dashboards without manual status chasing across repositories.
• Deduplication across Rust services: The same CVE in a widely used crate — openssl, tokio, serde, hyper, reqwest — appearing across multiple Rust services doesn't generate independent unrelated findings if your DefectDojo product structure is organized appropriately. Shared crate vulnerabilities surface as portfolio-level issues worth addressing with coordinated crate upgrades rather than per-repository one-offs.
• Unmaintained crate tracking beyond CVE scope: Cargo Audit's unmaintained crate warnings represent dependency risk that has no CVE equivalent — a crate that is no longer maintained may have security issues that will never receive an advisory. DefectDojo tracks these warnings in the same lifecycle as CVE findings, enabling teams to plan crate replacements before the risk becomes a CVE-confirmed incident.
• Cross-repository Rust portfolio visibility: Security teams managing multiple Rust services or libraries get aggregated metrics in DefectDojo — open advisories by severity, crate name, project, age, and SLA status — without reviewing per-repository Cargo Audit output manually. This aggregate view is what drives coordinated crate upgrade initiatives and library replacement planning.
• Developer-facing remediation tickets with upgrade guidance: Triaged Cargo Audit findings push from DefectDojo to Jira, GitHub Issues, or ServiceNow with advisory identifier, affected crate name and version, patched version, and advisory description — giving developers a directly actionable ticket: which crate to update and to what version.
• Audit trail for compliance: For Rust applications in regulated environments or those subject to SSDF, NIST SBOM, or internal AppSec policy requirements, DefectDojo's engagement history and finding lifecycle records provide documented evidence of continuous crate dependency scanning and remediation tracking.

How This Integration Works

Cargo Audit produces JSON output via its CLI that DefectDojo's Cargo Audit parser consumes directly.

Step 1 — Install Cargo Audit and run a scan

Install Cargo Audit as a Cargo subcommand:

cargo install cargo-audit

Run against a Rust project and capture JSON output:

# Basic scan — fetches latest RustSec database automatically

cargo audit

# JSON output for DefectDojo import

cargo audit --json > cargo-audit-results.json

# Include informational advisories in output

cargo audit --json --include=informational > cargo-audit-results.json

# Deny specific advisory types to control exit code behavior

# (still capture JSON regardless)

cargo audit --json \

--deny=warnings \

--deny=unmaintained \

> cargo-audit-results.json || true

# Scan a specific Cargo.lock file (useful in monorepos)

cargo audit --json \

--file /path/to/specific/Cargo.lock \

> cargo-audit-results.json || true

For CI pipeline integration:

# Capture JSON output regardless of exit code

cargo audit --json > cargo-audit-results.json || true

# GitHub Actions example

- name: Run Cargo Audit

run: cargo audit --json > cargo-audit-results.json || true

- name: Upload Cargo Audit results

uses: actions/upload-artifact@v3

with:

name: cargo-audit-results

path: cargo-audit-results.json

Step 2 — Import into DefectDojo

Use Cargo Audit Scan as the scan type:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Cargo Audit Scan" \

-F "file=@cargo-audit-results.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Step 3 — Reimport for recurring scans

For repositories scanned on every CI run or merge to main, use the reimport endpoint to update existing findings rather than accumulate redundant test records:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Cargo Audit Scan" \

-F "file=@cargo-audit-results.json" \

-F "test=<test-id>"

DefectDojo marks findings absent from the new scan as resolved, creates records for new findings, and leaves previously risk-accepted findings untouched.

Data Granularity: What Gets Imported

Use Cases

In a CI/CD pipeline for a Rust web service: Cargo Audit runs on every pull request and merge to main for a Rust API built on axum or actix-web. Results import into DefectDojo via the API at the end of the scan stage. Security engineers triage new findings weekly — Critical and High CVSS advisories are assigned to the responsible service owner immediately; unmaintained crate warnings are queued for a monthly dependency review sprint. Previously accepted findings don't re-appear in the active queue, keeping triage focused on genuine new risk.

Across a fleet of Rust infrastructure tooling: A platform engineering team builds internal tooling — CLI utilities, deployment automation, network proxies — in Rust across a dozen repositories. Cargo Audit runs in every repository's CI pipeline and imports into DefectDojo. The security team discovers that an advisory for openssl-sys affects nine of the twelve tools. A coordinated upgrade initiative is tracked in DefectDojo with per-repository assignment and a shared resolution deadline — visible in a single dashboard view rather than scattered across twelve independent Jira tickets.

For a Rust library published to crates.io: An organization maintaining an open-source Rust library used externally has heightened responsibility to track and remediate vulnerabilities promptly — affected downstream users depend on timely advisories and patched releases. Cargo Audit scans run against the library's own Cargo.lock on every release candidate. Results import into DefectDojo, where the security and library maintenance teams review findings before each release. Any Critical or High advisory blocks the release until resolved or formally assessed, with the DefectDojo engagement record providing documentation of the pre-release security review.

For tracking unmaintained crate technical debt: A long-lived Rust service accumulated dependencies over years of development, including several crates now flagged as unmaintained by the RustSec database. Cargo Audit findings for unmaintained crates import into a dedicated DefectDojo engagement for dependency health review, separate from CVE findings. The platform team works through replacement candidates over a planned multi-sprint effort — with each unmaintained crate tracked from identification through replacement and verified closure in DefectDojo, providing a documented record of proactive dependency risk reduction.

Operational Tips

• Use || true to decouple scan exit code from pipeline failure: Cargo Audit exits non-zero when advisories are found — including for unmaintained crate warnings if --deny=unmaintained is set. Using || true ensures JSON output is captured and imported into DefectDojo regardless of advisory state. Handle gate logic separately — failing builds only on new Critical advisories not already tracked in DefectDojo as accepted — rather than blocking on any advisory.
• Commit Cargo.lock for application repositories: Cargo Audit requires Cargo.lock to scan the full transitive dependency tree. For binary crates and application repositories, Cargo.lock should always be committed. For library crates, Cargo.lock is typically gitignored (since it's regenerated by downstream consumers), but consider running Cargo Audit against a generated lock file in CI to catch advisory issues before library users encounter them.
• Separate vulnerability and informational findings by engagement: Cargo Audit's --include=informational flag adds unmaintained crate and notice advisories alongside vulnerability findings. These have different remediation owners, timelines, and urgency profiles. Importing them into separate DefectDojo engagements — vulnerability advisories in one, unmaintained and informational in another — keeps SLA policies and assignment models appropriate to each finding type.
• Map one DefectDojo product per Rust repository: A one-to-one mapping between Rust repositories and DefectDojo products keeps deduplication clean and ownership clear. For Cargo workspaces with multiple member crates, run cargo audit at the workspace root — it scans the unified Cargo.lock and produces a single result set covering all workspace members.
• Use RustSec advisory categories for triage prioritization: RustSec advisories include category tags such as crypto-failure, memory-corruption, memory-exposure, thread-safety, and format-injection. These categories provide triage context beyond CVSS scores — a memory-corruption advisory in a crate used in a network-facing parser warrants faster remediation than the same CVSS score in an offline data processing utility. Capture the category in DefectDojo finding notes during triage.
• Review cargo update output after advisory remediation: When an advisory is resolved by running cargo update, the resulting Cargo.lock change may also affect other crates in the dependency tree. Running Cargo Audit again after the update and reimporting into DefectDojo confirms that the advisory is closed and surfaces any new advisories introduced by the updated dependency graph — closing the remediation loop cleanly.
• Pair Cargo Audit with cargo clippy and cargo deny for broader coverage: Cargo Audit focuses on published RustSec advisories. cargo deny extends coverage to license policy enforcement, crate source restrictions, and duplicate dependency detection. Running both tools and importing Cargo Audit results into DefectDojo while using cargo deny for CI gate logic gives complementary coverage — advisory tracking in DefectDojo, policy enforcement in the pipeline.