From cdd85808756bc744793e5b75001c0dcb86ea6799 Mon Sep 17 00:00:00 2001
From: "dzianis.lituyeu" <dzianis.lituyeu@constructor.tech>
Date: Mon, 25 May 2026 16:34:34 +0300
Subject: [PATCH] Add deny and audit checks

---
 .cargo/audit.toml        |  5 ++++-
 .github/workflows/ci.yml | 21 +++++++++++++++++++++
 deny.toml                | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+), 1 deletion(-)
 create mode 100644 deny.toml

diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 9934f20..6f067e4 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -1,2 +1,5 @@
 [advisories]
-ignore = ["RUSTSEC-2023-0071"] # rsa, no safe upgrade is available
+ignore = [
+    "RUSTSEC-2023-0071", # rsa crate, no safe upgrade available
+    "RUSTSEC-2025-0134", # rustls-pemfile unmaintained, dev-dep only
+]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b8fc0e7..67d7274 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -71,6 +71,27 @@ jobs:
           path: target/release/tiny-proxy
           if-no-files-found: error
 
+  security:
+    name: Security (deny + audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@cargo-deny
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      - name: cargo deny check
+        run: cargo deny check
+
+      - name: cargo audit
+        run: cargo audit --deny warnings
+
   docker:
     name: Docker build
     runs-on: ubuntu-latest
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..973413a
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,32 @@
+# cargo-deny configuration (0.18+ format)
+
+[advisories]
+yanked = "deny"
+
+# rustls-pemfile is archived — replacement is rustls-pki-types PemObject (1.9+).
+# Only used in tests/dev-deps; migration tracked separately.
+[[advisories.ignore]]
+id = "RUSTSEC-2025-0134"
+
+[licenses]
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "0BSD",
+    "CC0-1.0",
+    "Unicode-DFS-2016",
+    "Unicode-3.0",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "deny"