Free tool · 2,558 advisories, 1,634 crates · data from Oct 24, 2026 · runs in your browser
Is your Cargo.lock safe?
Drop in a Cargo.lock. You get every crate version with a known security bug, the advisory, the version that fixes it, and the one cargo update line that moves you there. Copy the script, run it, ship.
Keep it clean every week
New advisories land every week. Crate Portfolio re-checks your lockfile weekly and emails you only what changed: $39/month. Or one full prioritized report for $49.
Track my lockfile →What it checks
- Vulnerabilities and unsound APIs. Every package in the lockfile (crates.io, git and your own workspace crates) is matched by name and exact version against the 2,558 crates.io advisories in OSV's export: the full RustSec database plus GitHub-reviewed advisories that have no RUSTSEC ID. Withdrawn advisories are left out.
- The fix. For each vulnerable version we pick the lowest published fixed version that clears every advisory on that crate and is not yanked, then write
cargo update -p crate --precise version(withcrate@versionwhen your lockfile holds two copies). When the fix is a semver-breaking jump, we say so and name the crates that pull it in, because cargo will refuse until their requirement allows it. - Unmaintained crates. RustSec's "unmaintained" notices, linked to the crate's security history.
- Yanked versions. From our crates.io cache of the 1,019 most-used crates, every version with its yanked flag. Crates outside that set are not checked for yanks.
Verified against cargo-audit
Before launch we ran this checker and cargo audit (with a fresh clone of the RustSec database) on the same real lockfiles. On a 394-package service lockfile both found the same 17 RustSec vulnerabilities in 6 crates and the same 4 unsound and 1 unmaintained warnings; we also flag GitHub-only advisories (openssl, opentelemetry_sdk) that cargo-audit does not read. On ripgrep 11.0.0's lockfile both found the same 7 vulnerabilities, 5 unsound, 3 unmaintained and 1 yanked crate.
Privacy
Your lockfile never leaves the page. It downloads one static file, advisories.json (the advisory and yank data, refreshed with every site build), and matches in your browser. Agents can fetch the same file.
Related
- Every Rust security advisory, explained with the fix
- Cargo.toml checker: outdated versions, licenses and MSRV, live from crates.io
- Crate Portfolio: weekly monitoring of your lockfile
- Paid fixes: fixed in 24 hours or a full refund
Sources
- RustSec Advisory Database (CC0-1.0) and GitHub advisories via OSV's crates.io export, downloaded Oct 24, 2026
- Yanked flags: crates.io API, our cache of the top crates
Up next
Most read on the site this weekcrates.io download count: 80% of ours arrived with a new versionWhat the crates.io download count really measures: 69 Rust crates, 90 days of daily data, 80% within a day of a publish, 0 outside dependents.Read it next →Art: Nicholas Roerich, Sanctuaries and Citadels (1925). Public domain, via Wikimedia Commons.
.jpg){kind=link}