eric / rustwarden

# cargo-audit configuration (Phase 5 — production gate).
#
# Each entry below is a transitive advisory we have audited and accepted
# pending an upstream fix. Every ignore line MUST link to the section in
# `docs/SECURITY_AUDIT_2026_05.md` that documents the rationale.
#
# Run locally: `cargo audit`
# CI: configure the gate to fail on `error: 1 vulnerability found!` and
# exit 0 when only `warning:` lines remain.

[advisories]
ignore = [
    # rsa 0.9.x — Marvin Attack (timing side-channel, RUSTSEC-2023-0071).
    # Pulled transitively by sqlx-mysql (sea-orm-migration), openidconnect,
    # jsonwebtoken, activitypub_federation. We only use RSA for ActivityPub
    # actor keys (RFC 0005) — JWT signs HS256, no RSA. No upstream fix.
    # Tracked in docs/SECURITY_AUDIT_2026_05.md §H3.
    "RUSTSEC-2023-0071",

    # lexical-core 0.7.6 — multiple soundness issues (RUSTSEC-2023-0086).
    # Reached via imap-proto < imap (used by EmailService for bounce
    # detection). Not on the request hot path; bounded input from a
    # configured IMAP server. No upstream fix planned in imap 2.x.
    # Tracked in docs/SECURITY_AUDIT_2026_05.md §H3.
    "RUSTSEC-2023-0086",

    # rand 0.8.5 / 0.9.2 — unsound when a custom logger is configured
    # globally (RUSTSEC-2026-0097). Rustwarden does not install such a
    # logger; only `tracing-subscriber` is used. Pulled transitively by
    # tower-sessions, sqlx-postgres, totp-rs, quinn-proto.
    # Tracked in docs/SECURITY_AUDIT_2026_05.md §H3.
    "RUSTSEC-2026-0097",
]