Add deny and audit checks

.cargo/audit.toml

@@ -1,2 +1,5 @@
 [advisories]
-ignore = ["RUSTSEC-2023-0071"] # rsa, no safe upgrade is available
+ignore = [
+    "RUSTSEC-2023-0071", # rsa crate, no safe upgrade available
+    "RUSTSEC-2025-0134", # rustls-pemfile unmaintained, dev-dep only
+]

.github/workflows/ci.yml

@@ -71,6 +71,27 @@ jobs:
           path: target/release/tiny-proxy
           if-no-files-found: error
 
+  security:
+    name: Security (deny + audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@cargo-deny
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@cargo-audit
+
+      - name: cargo deny check
+        run: cargo deny check
+
+      - name: cargo audit
+        run: cargo audit --deny warnings
+
   docker:
     name: Docker build
     runs-on: ubuntu-latest

deny.toml

@@ -0,0 +1,32 @@
+# cargo-deny configuration (0.18+ format)
+
+[advisories]
+yanked = "deny"
+
+# rustls-pemfile is archived — replacement is rustls-pki-types PemObject (1.9+).
+# Only used in tests/dev-deps; migration tracked separately.
+[[advisories.ignore]]
+id = "RUSTSEC-2025-0134"
+
+[licenses]
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "0BSD",
+    "CC0-1.0",
+    "Unicode-DFS-2016",
+    "Unicode-3.0",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "deny"