Where Does cargo-deny Store Its Config?
cargo-deny reads advisories, bans and licenses from deny.toml in the repo root, creatable with cargo deny init.
Last updated
cargo-deny centers on deny.toml: graph targets, advisory ignores, banned crates, license allow lists, all lint graded. Checks run against the Cargo dependency graph, so the file travels with the workspace it guards.
The advisory database itself lives apart in ~/.cargo/advisory-db, fetched from the RustSec feed. That split matters in practice: deleting deny.toml resets policy, deleting the db just forces a refetch.
Where cargo-deny stores this, by platform
[RepoDir]\deny.toml
Advisories, bans, licenses, sources policy. Advisory db caches separately in ~/.cargo/advisory-db. Generate the starter file with cargo deny init.
[RepoDir]/deny.toml
Same file. Multiple versions and wildcard bans accept reason fields, which future you will thank present you for writing.
[RepoDir]/deny.toml
Same layout. Override the path per run with the root --config flag; CI typically pins one shared file this way.
Frequently asked questions
How do I create my first deny.toml?
Run cargo deny init in the repo root. It writes a templated deny.toml with every section defaulted, which beats composing graph, bans and licenses sections by hand.
Can I keep the config outside the repo root?
Pass a different path with the root --config option (cargo deny --config path/to/config.toml). CI matrices use this to share one policy file across workspaces.
Notice an outdated path? Let us know.