QNSQY dependency advisory summary  (cargo-audit / cargo-deny, RustSec advisory DB)
Cargo.lock: 875 crate dependencies scanned.

Exploitable vulnerabilities (active CVE): 0

Advisories (unmaintained / unsound) — all transitive, dev, or GUI/TUI-only:
  RUSTSEC-2026-0162  pqcrypto-traits 0.3.5      unmaintained (PQClean archived)   HQC/Falcon FFI
  RUSTSEC-2026-0165  pqcrypto-falcon 0.4.1      unmaintained (PQClean archived)
  RUSTSEC-2026-0168  pqcrypto-hqc 0.2.2         unmaintained (PQClean archived)
  RUSTSEC-2026-0163  pqcrypto-internals 0.2.11  unmaintained (PQClean archived)
  RUSTSEC-2026-0002  lru 0.12.5                 unsound (IterMut)        via ratatui (TUI)
  RUSTSEC-2025-0141  bincode 2.0.1              unmaintained            via slint (GUI build)
  RUSTSEC-2024-0436  paste 1.0.15               unmaintained            via slint/ratatui/cryptoki
  RUSTSEC-2021-0145  atty 0.2.14                unsound                 dev-only
  RUSTSEC-2024-0375  atty 0.2.14                unmaintained            dev-only
  RUSTSEC-2021-0139  ansi_term 0.12.1           unmaintained            dev-only

Pre-1.0 (release-candidate) crypto crates in the shipped binary (no advisory; maturity-tracked):
  ml-dsa 0.1.0-rc.7,  slh-dsa 0.2.0-rc.1,  signature 3.0.0-rc.10

cargo-deny gate: advisories FAILED (the four archived pqcrypto-* crates); bans / licenses / sources OK.
Status: 0 exploitable CVEs. The above are acknowledged and tracked; remediation = migrate off
archived FFI bindings and to stable (non-RC) crypto crates as upstream publishes them.