cargo-auditable

> and static compilation probably just hides the problem unless security scanners these days can identify statically compiled vulnerable versions of libraries Some scanners like trivy [1] can scan statically compiled binaries, provided they include dependency version information (I think go does this on its own, for rust there's [2], not sure about other languages). It also looks into your containers. The problem is what to do when it finds a vulnerability. In a fat app with dynamic linking you could exchange the offending library, check that this doesn't break anything for your use case, and be on your way. But with static linking you need to compile a new version, or get whoever can build it to compile a new version. Which seems to be a major drawback of discouraging fat apps. 1: https://github.com/aquasecurity/trivy 2: https://github.