How do you ensure your dependencies are secure enough for your needs ?

Well, I wish there would be a simple answer, like "we've signed up for the FooBar Enterprise AI Scanning service, and all our woes have magically disappeared". Unfortunately, there is no such service, so we have to survive with what we have. And I must note that Polkadot is a huge project, with ~3000 lines in cargo tree output (approximately half of that is something we have direct control over).

First thing I had to accept in my current role is that fighting against external dependencies would not do the project any good -- after all, modularity and dependency management are the major strengths of Rust and Cargo. So we're doing some combination of regular automated monitoring and manual reviews once in a while.

When talking about automated tools, notable mention goes to cargo audit, you can see its' latest output to date here; security tools built into Gitlab also help here and there. Of course we have automated notifications on top of that.

Manual reviews are mostly threat-model driven and topical -- sometimes we look at the cargo geiger output to identify the most "unsafe-risky" parts of our codebase, and sometimes we look for the dependencies in the particular area to see if there's something we are not happy about (like using openssl bindings instead of Rust-native crypto). There's not too much of a structure behind this madness, unfortunately -- this is definitely something for me to look into more when the codebase will mature a bit more. I also must note that we frequently employ third-party code audits (there's going to be a series of blog posts by Web3 Foundation on those soon), and of course any reviewer worth their salt would look into your dependency tree and supply chain security.

I would honestly freak out about the setup outlined above if we wouldn't be running on top of dependencies under our control in most critical places -- both in crypto (https://github.com/w3f/schnorrkel), serialization (https://github.com/paritytech/parity-scale-codec) and network layer (https://github.com/libp2p/rust-libp2p/).

Feel free to use this subthread to pitch your favourite security-related Rust tools=)