a public repository, read by nittim
clap-rs/clap security audit
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
A full featured, fast Command Line Argument Parser for Rust
Rust · 16.8k stars · last push November 2, 2026
clap-rs/clap is a command line argument parser written in Rust. The repository provides a full featured and fast tool for parsing command line arguments in Rust applications.
nittim scanned 480 files in clap-rs/clap and found evidence of vulnerable runtime dependencies. The scan identified 2 vulnerable packages. The package pulldown-cmark has advisory RUSTSEC-2026-0414 and advisory RUSTSEC-2026-0433.
Developers should run an audit to understand the details of these vulnerabilities and determine what action is needed. After addressing the issues, rescan the repository to confirm the findings have been resolved.
Written from nittim's own scan on November 3, 2026; rescanned when the repository changes.
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 480 of 480 eligible files. Commit ec93e71. 2026-11-03.
What the scanners found
- Committed secrets on production paths
- 0
- Vulnerable runtime dependencies
- 2
pulldown-cmark (RUSTSEC-2026-0414, RUSTSEC-2026-0433)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in clap-rs/clap?
- nittim read 480 of 480 eligible files in clap-rs/clap. The reading ran on November 3, 2026. It was taken at commit ec93e71.
- Did nittim find committed secrets or vulnerable dependencies in clap-rs/clap?
- The rule-based scan found 0 committed secrets and 2 vulnerable dependencies in clap-rs/clap. Affected: pulldown-cmark (RUSTSEC-2026-0414, RUSTSEC-2026-0433).
- Is clap-rs/clap production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
Add the badge to your README
[](https://nittim.com/library/clap-rs/clap)