# rust-guide: ANSSI's recommendations for writing secure Rust

> The ANSSI-FR rust guide is a free, doctrinal set of recommendations for building secure applications in Rust, published by the French cybersecurity agency and written as an mdBook you can read online or build yourself. It is aimed at teams with strong security requirements who already know the language and want to know where its footguns are.

**ANSSI-FR/rust-guide** — Recommendations for secure applications development with Rust

- Repository: https://github.com/ANSSI-FR/rust-guide
- Website: https://anssi-fr.github.io/rust-guide
- Stars: 660 · Forks: 52
- Language: Rust
- License: NOASSERTION
- Published: 2026-10-21 · Updated: 2026-10-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/anssi-fr-rust-guide

## A doctrinal document, not a tutorial

The repository is titled a guide to develop secure applications with Rust, and the project description calls it recommendations for secure applications development with Rust.

The objectives section sets out the scope precisely. The objective of the document is to provide hints and recommendations for secure applications development using the Rust programming language. It is not intended to be a course on how to write Rust programs, because there are already plenty of good learning resources for that purpose, and the README points to the external references section for them.

The stated purpose is instead to guide the programmer and inform them about certain pitfalls, especially when they are involved in developing applications with strong security requirements. The recommendations form a complement to the good level of trust the Rust language already provides.

That framing has a practical consequence for how the document is structured, and the README states it: reminders are sometimes necessary for clarity, and the experienced Rust programmer may rely solely on highlighted inserts labelled Rule, Recommendation, Warning and so on.

So this is a reference to skim and revisit rather than a path to follow front to back. The audience is a developer who writes Rust for a living and needs to know where the language's safety guarantees stop, which is a question the language itself cannot answer.

The provenance matters too. The project is managed by ANSSI, the French cybersecurity agency, and the README links to the agency's open source strategy page, and the badges indicate a doctrinal category project and a collaborative opening level on code.gouv.fr.

## The distinction that shapes every recommendation

The reason this guide exists at all is a specific gap in the Rust story, and it is worth stating in the guide's own terms.

Rust provides a high level of trust in memory safety. That trust comes with a set of footguns that are not memory-safety bugs: logic errors, integer overflow behaviour, unwrap and panic paths, the unsafe escape hatch, secret handling, and error handling that silently continues. A program can be perfectly memory safe and still be insecure.

So the guide is about the second category. Every rule it states addresses something Rust does not protect you from.

The repository layout backs up the reading-time model. There is an src directory with the book content, book.toml along with book.toml.en and book.toml.fr, mdbook-plugins for the custom preprocessors, an examples directory with its own Cargo.toml and Cargo.lock and an unsafe2 example, and a set of local assets like en.pws and fr.pws. There is a lang.sh script, custom env CSS and JS files, vars-en.js and vars-fr.js for the two language editions, and a flake.nix with a flake.lock for a reproducible development environment.

The presence of both an English and a French edition, with separate book configuration files and separate variable files, tells you this is a maintained translation effort rather than an English afterthought. It also means the two editions may not be in lockstep, which is worth checking if your team works in one language and the agency updates in the other.

## Building the book yourself, and the preprocessors it needs

The guide is published as an mdBook, and the README explains that you can install mdbook and the required preprocessors.

The install is four cargo commands, and the first one is not a plain crate install. mdbook comes from a fork hosted by the agency's own GitHub organisation, pinned to a specific revision:

```bash
cargo install mdbook --git https://github.com/hg-anssi/mdBook.git --rev c5a35b9296c6d5e48570e30022bd69403050a9f4 --locked
cargo install --path ./mdbook-checklist --locked
cargo install --path ./mdbook-code-align --locked
cargo install --path ./mdbook-extensions --locked
```

Three of the four are local preprocessors from the mdbook-plugins directory: a checklist plugin, a code alignment plugin and an extensions plugin. The checklist plugin is what produces the highlighted inserts the README mentions, so it is part of the document's structure rather than decoration.

Building and opening the book is one command:

```bash
$ mdbook serve -o
```

The Dockerfile does the same thing in a container, on a rust:1.91.1-slim-trixie base, installing the pinned mdbook and then each local preprocessor in turn, removing the cargo git and registry directories after each install so the image layers do not carry the sources.

The reason the fork is pinned to a revision rather than tracked as a branch is worth pausing on. The rendered guide depends on a specific mdbook build with the agency's own extensions, so a reader who installs a different mdbook from crates.io may get a book that does not build, or one that builds without the checklist rendering. If you fork this to host it internally, pin the same revision.

## How to read it, and what it deliberately leaves out

The README describes the document as an ongoing version with all contributions welcome, and the contributing guidance lives in CONTRIBUTING.md. The online version is at anssi-fr.github.io/rust-guide, and the project is under active development with the last push on 2026-05-19 and the repository not archived.

The most useful thing a reader can take from the objectives section is the negative space. The guide is not a Rust tutorial, it does not cover how to write Rust programs, and the recommendations are a complement to the trust the language already provides rather than a replacement for it. If you want to learn the language, the external references list is the right place to start: the Rust programming language site, the Rust book, the Edition Guide and the Rust API Guidelines, plus a note that an up-to-date list of book resources and associated tools lives in the main Rust documentation page.

The practical reading strategy follows from the format. An experienced Rust programmer can rely on the highlighted inserts alone, which means the guide is designed to be searchable. Someone reviewing a pull request can look up the relevant rule for a pattern they have just seen, which is how these documents actually get used in a team, one rule at a time rather than cover to cover.

The security posture of the document itself is worth noting. The repository carries a SECURITY.md, a .gitlab-ci.yml alongside a .github directory, a .envrc for direnv, and a Dockerfile, so the build is reproducible and the project has a place to report problems. The licence is the Open Licence 2.0, in a file named LICENCE.md, which is the open licence France publishes for government works, and the platform metadata classifies the repository licence as a custom one GitHub cannot categorise.

## Where the rust-guide is the wrong tool

The first wrong-tool case is learning Rust. The README rules this out explicitly, and it is the right call. The guide assumes you already know the borrow checker, the trait system and the ownership model, and it spends its words on the security consequences of choices you are already making. A newcomer following it will meet rules without the background to judge them.

The second is treating it as a certification. This is a set of recommendations with the authority of the agency behind it, and it carries a doctrinal category badge, but it is guidance rather than a certified baseline. An audit that asks whether a product conforms to a scheme needs a scheme, and a document titled a guide is not one.

The third is a project whose risk is not in the code. The guide is about application-level pitfalls in Rust, so it is the wrong document for securing the build pipeline, the dependency supply chain, the deployment configuration or the host. A project worried about a supply chain attack gets no help here, and assuming otherwise would be a mistake.

The fourth is a project outside France using the French edition and relying on it being current. The two editions are built from separate book configuration files and separate variable files, and nothing in the README states that they are updated in lockstep. If your team reads French and the agency updates English first, the gap is on you to check.

The alternative to weigh is the standard Rust documentation set, the book, the Edition Guide and the API Guidelines, which cover the same language from a different angle with a different scope. The rust guide is not a substitute for them. It is a security overlay, and it assumes you have already read the rest.

## Conclusion

rust-guide fits a team writing Rust that has to meet a security bar and wants an external, government-backed list of the traps in the language rather than a tutorial. It is the wrong choice for learning Rust, since the README says explicitly that it is not a course on how to write Rust programs, and it is the wrong choice as a compliance checklist, since it is guidance rather than a certified baseline. Before adopting it as a reference, read the objectives section so you know what it deliberately leaves out, and check the language of the rules, because the English and French editions are separate and one may be ahead of the other.

## FAQ

### What is the ANSSI-FR rust-guide?

It is a document of hints and recommendations for secure application development in Rust, published by the French cybersecurity agency as an mdBook, and explicitly not a course on how to write Rust programs.

### How do I build the rust-guide locally?

Install mdbook from the agency's pinned fork revision together with the local checklist, code-align and extensions preprocessors, then run mdbook serve -o to build and open the book.

### Which programming language versions does the rust-guide target?

The README does not list supported Rust versions, and it does not aim to, since the guide is about application-level pitfalls rather than language editions, so the Edition Guide is listed as an external reference instead.

### What licence is the rust-guide published under?

The README states the document is published under the Open Licence 2.0, in a file named LICENCE.md, and the repository platform classifies the licence as a custom one GitHub cannot categorise.

## Sources

- [ANSSI-FR/rust-guide on GitHub](https://github.com/ANSSI-FR/rust-guide)
- [Issues](https://github.com/ANSSI-FR/rust-guide/issues)
- [Project website](https://anssi-fr.github.io/rust-guide)
- [README](https://github.com/ANSSI-FR/rust-guide/blob/master/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/anssi-fr-rust-guide