molluskandClaude Opus 4.8
465c7ba2b0
Supersede bare cargo-audit with an enforceable four-part policy, validated against the current tree with cargo-deny 0.19.9 (advisories/bans/licenses/ sources all pass): - advisories: deny vulnerabilities + yanked; ignore the two *unmaintained* warnings (paste RUSTSEC-2024-0436, audiopus_sys RUSTSEC-2026-0150) with rationale. Both are transitive and pinned via Cargo.lock, so a future malicious release can't reach us until a deliberate cargo update. - sources: trust only crates.io; deny unknown registries and git sources (core anti-hijack control). - bans: deny wildcard version reqs; warn on duplicate versions. - licenses: permissive allow-list covering the current graph. Mark peerspeak publish = false (it's an application, not a published library): blocks accidental cargo publish and lets [licenses.private] skip the missing-license check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>