cargo audit finds one advisory (RUSTSEC-2023-0071, no fix). Assessed not exploitable here: server only verifies RSA signatures, holds no private key. Session, Google verification, rate limit, backup posture documented alongside.