A data-driven security audit of nearly 200k crates.io packages using cargo-deny, examining vulnerability rates, unsound code, and how dependency complexity drives risk in the Rust ecosystem.
  • MoSal@programming.dev
    2·
    2 months ago

    I have the feeling that this wasn’t even done properly (e.g. checking default versions only). Using downloads alone is also not a good filter.

    I may give this some time tomorrow and provide my own numbers.