Project security

Open a project from unknown sources

Every time you open a project for the first time, the IDE shows the Trust Project dialog. This helps to ensure that the project is safe to perform the following actions:

• Invoke Cargo, rustc, Rustfmt, and other Rust tools, which can be overridden to execute arbitrary (potentially malicious) code.

• Execute build scripts and procedural macros, which can also contain arbitrary code.

• Interact with VCS.

• Perform other tasks that execute code.

You can select one of the following actions:

• Preview in Safe Mode: in this case, RustRover opens the project in Safe Mode, meaning you can browse the project's sources, but there are restrictions in executing code, performing build-related activities, and running scripts. Essentially, the IDE functions as a text editor.

  RustRover notifies you about Safe Mode on top of the editor area. You can click the Trust project link and load your project at any time.

  

  If you try to reload the project or execute targets using menu items, dedicated tool windows, or the Run Anything window, RustRover will prompt you to confirm that you trust the project before proceeding:

  

• Trust Project: in this case, RustRover opens and initializes the project, resolves project plugins, adds dependencies, and enables all RustRover features.

• Don't Open: in this case, RustRover cancels the action.

Startup tasks

When you open a project created on a different machine, it might contain some scripts or tasks that are executed during the opening process. If such tasks are found, RustRover displays a notification suggesting that the code you are about to execute might be harmful.

You can review what tasks will be executed and modify the settings.

Safe mode preview limitations

If you open a project in Safe Mode, the following limitations will apply:

• Cargo importing is disabled. As a result, build scripts and macros are not executed, and dependencies are not resolved.

• The Rust compiler (rustc) is disabled.

• External Rust tools, such as cargo-check, Clippy, and Rustfmt, are disabled.

• Startup tasks: any scripts or tasks that are executed during the opening process are disabled.

• VCS support: VCS support is fully disabled.

• File Watcher scripts will not wake up and run corresponding tools.

Trusted locations

You can configure what sources RustRover should consider safe and trust implicitly. For example, you can add your home directory to the trusted locations. In this case, RustRover will implicitly trust all projects located there.