Aptos Labs and Trail of Bits launch rust-review for Rust security checks

Aptos Labs and Trail of Bits have released rust-review, a security review plugin aimed at Rust code paths where the compiler and clippy can still miss dangerous behavior. The tool is built to surface misused unsafe code, silent overflows and nondeterminism, then push those findings into the same review flow auditors already use.

Trail of Bits published the release on July 13, 2026 as part of an update to its Testing Handbook, adding a new chapter that it describes as a comprehensive guide to security testing Rust programs. The handbook material also frames rust-review as a Claude Code plugin for automated Rust security reviews, making it a hands-on assistant for code review rather than a standalone scanner.

The plugin’s coverage comes from empirical bug-shape research and audit work spanning 245 memory-corruption advisories, 177 unsound safe-API advisories, 150 denial-of-service advisories and 60 thread-safety advisories in the RustSec Advisory Database, which Trail of Bits says now contains 1,078 entries. That research base feeds the tool’s documented use cases, including safe-unsafe boundary auditing, memory safety checks inside unsafe blocks, concurrency hazards, panic-induced denial of service on servers, FFI safety and async-runtime mistakes.

That makes rust-review most relevant in the exact places Rust teams tend to lean on discipline and review culture instead of compiler guarantees alone. A codebase with custom unsafe wrappers, networking services, foreign-function interfaces or async runtimes is the kind of project that can benefit first, especially when small mistakes would otherwise hide behind “it compiles” confidence. Silent arithmetic overflows and nondeterministic behavior are especially costly in security-sensitive systems, where a passing build does not mean the logic is safe.

Aptos has a direct stake in that workflow. Its documentation says it provides an official lightly supported Rust SDK in the Aptos-core repository and lists Rust among the languages it supports for building on the blockchain. In other words, the launch lands in a community where Rust is already part of the production stack, not just an academic preference.

Trail of Bits has been moving in the same direction for months. It shipped a Claude plugin for dimensional analysis in March 2026, published a C/C++ Testing Handbook chapter in April 2026 and released a fuzzing chapter in February 2024. rust-review fits that pattern: it turns repeatable auditor judgment into tooling, and it points to a broader shift toward security-focused Rust workflows that catch bugs before they escape review.