Tool Uses Rust Compiled Symbols to Detect Capability Changes in Crate Updates

A developer has built a Rust security auditing tool that analyzes compiled symbol tables to detect when a crate update gains new capabilities, such as spawning processes or opening network connections. The approach exploits Rust's v0 symbol mangling, which demangles back to readable paths, allowing comparison of undefined symbols between old and new crate versions. The tool diffs demangled symbols across version bumps recorded in Cargo.lock, flagging high-severity changes and known advisories like RUSTSEC entries without generating excessive noise. However, the author acknowledges a key limitation: malicious logic hidden inside a build.rs script runs at compile time and leaves no trace in the symbol diff, meaning source review remains necessary for that threat. The project is released as a MIT-licensed composite GitHub Action and is available publicly on GitHub.