Question on Dependency Security / Supply Chain Security

Hey, thank you for providing yet another nice tool for making the world a bit safer!

Since this tool is written in Rust and has quite a few direct and transitive dependencies, I was wondering if you could share some insight on ensuring you don't pull in malware by accident. This is a thing I'm struggling with a bit whenever I see some software is written in Rust or whenever I inherit Rust code to work on.

I know this is not an issue and I'm sorry for adding triage overhead, but seems to be the most appropriate place to ask such a question... well apart from a mailing list :D

Thank you, Jan