Rust (Beta)
This article shows you how to analyze applications written in Rust using Qwiet AI by Harness. It assumes that you have already set up and authenticated with Qwiet.
Requirements
See Prerequisites for more information.
Analyzing your Rust application
To analyze your Rust application, run:
sl analyze --app <name> --rust <path>
| Parameter | Description |
|---|---|
--app <name> | The name of the application to be analyzed (maximum length: 100 characters) |
--rust | The flag identifying the application's language |
<path> | The path to your project |
See the CLI reference for additional sl analyze options.
Additional parameters
The analysis accepts additional parameters after a double hyphen --.
sl analyze --app <name> --rust <path> -- ...
To exclude specific files or directories from the analysis:
sl analyze --app <name> --rust <path> -- --exclude <path>
To exclude files or directories based on a regular expression match:
sl analyze --app <name> --rust <path> -- --exclude-regex <expression>
| Additional parameter | Description |
|---|---|
--exclude | Exclude files or folders during CPG generation (paths relative to the project directory or absolute paths). Can be specified multiple times. |
--exclude-regex | Exclude files or folders whose paths match the given regular expression (matched against paths relative to the project directory) |
--no-sysroot | Skip sysroot loading. Faster, but standard library symbols are not resolved |
--no-resolve-cfg | Do not resolve #[cfg(...)] attributes. Conditional compilation is not evaluated, so both enabled and disabled code paths may appear in the analysis |
Rust toolchain support
The Rust analyzer requires both rustc and cargo to be installed and available on your PATH. Run sl check-environment --rust to verify your setup.
By default, the analyzer loads the Rust sysroot to resolve standard library symbols and evaluates #[cfg(...)] attributes (for example, feature flags). Use --no-sysroot or --no-resolve-cfg after the double hyphen when you need faster analysis and can accept reduced type information.
Scanning for open-source vulnerabilities
For SCA, Qwiet looks for Cargo.toml and Cargo.lock in the project path you provided when running sl analyze. If your project has a Cargo.toml but no Cargo.lock, Qwiet may attempt to generate a lockfile using cargo generate-lockfile so transitive dependencies can be included in the scan.
Depending on how your project repo is structured, you may also need to provide an additional configuration option so that Qwiet AI by Harness can identify where your dependencies are located (for example, if you're running sl analyze for a package other than ., use --oss-project-dir <project-dir> to specify the location of the directory where Cargo.toml or Cargo.lock is located).
Sample usage
sl analyze --app shiftleft-rust-example --rust .
Tagging results with your branch name
To include the branch name in your Qwiet AI by Harness results, allowing you to distinguish one set of results from another, add the following to your invocation of Qwiet:
sl analyze --app shiftleft-rust-example --rust --tag branch=`git symbolic-ref --short HEAD` .
If you're working in a GitHub environment (e.g., GitHub Actions), you can also use --tag branch=${{ github.head_ref }} to populate your branch name.
If you don't provide a branch name, but Qwiet detects one available in your environment, it will use that name.
Troubleshooting
If you have any issues scanning your project, please see our general troubleshooting page.