From c9e9221caf90ee1cdafe6e76e12c094e50c8d4c9 Mon Sep 17 00:00:00 2001
From: whit3rabbit <whit3rabbit@users.noreply.github.com>
Date: Fri, 27 Mar 2026 23:45:36 -0500
Subject: [PATCH] ci: add cargo-audit step to catch crates with known CVEs

Runs after cargo test in the test job. Uses --locked for reproducibility.
---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 581e58f..379c88d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,10 @@ jobs:
         run: cargo build
       - name: Test
         run: cargo test
+      - name: Security audit
+        run: |
+          cargo install cargo-audit --locked --quiet
+          cargo audit
 
   build-release:
     name: Build (${{ matrix.target }})