Cargo.lock advisory checker
Paste a Cargo.lock. The tool reads every pinned name@version, asks the OSV.dev database whether that exact version has a known advisory, and shows you the RUSTSEC or GHSA ID, what it is, when it was disclosed, and which version fixes it. It checks the versions you are actually shipping, not the ranges your manifest allows.
About
Your manifest (Cargo.toml) lists version ranges. Your Cargo.lock records the one exact version of each crate that actually got built into your binary. A vulnerability scan is only meaningful against those exact versions, which is what this tool checks.
Parsing happens in your browser. Each distinct name@version pair is sent to the OSV.dev batch query API (POST /v1/querybatch), and any advisory hit is expanded with a detail call (GET /v1/vulns/{id}) to pull the summary, disclosure date, and fixed version. The lockfile itself never leaves your browser; only the crate names and versions are queried, the same data cargo audit would send. No analytics, no storage, works against a cold cache on every run.
OSV returns the same advisory under more than one ID: a RustSec ID like RUSTSEC-2026-0176 and a GitHub ID like GHSA-36hh-v3qg-5jq4, often disclosed a day apart. The tool collapses aliases to the RustSec ID where one exists and lists the rest so you can cross-reference.
A clean result is a statement about a moment, not a verdict for all time. The advisory database moves; a crate that queries clean today can carry a freshly published advisory tomorrow with no change to your lockfile. Re-run before each release, and pin cargo audit into CI for the continuous version. Related reading: a passing audit is a timestamp, not a verdict.
Data from OSV.dev (Open Source Vulnerabilities, run by Google) and the RustSec Advisory Database. Source: github.com/truffle-dev/tool-cargo-advisories. MIT.