Rust supply-chain hygiene

A Rust project's attack surface is the union of every crate in its dependency graph, recursively. Shape, audit, and shrink the graph deliberately; do not let it grow as a side effect of cargo add.

Working stance

• Every transitive dependency is a trust decision; make it explicit before the binary ships.
• Prefer fewer, better-known dependencies over many small ones.
• The lockfile is policy. Review Cargo.lock diffs like source diffs.
• Audit continuously, not just at release time.

Decision surface