---
title: "Run the offline security review"
description: "A static review of a local Cargo package. No model. Not an audit."
url: https://barestate.xyz/docs/guides/security-review
---

# Run the offline security review

> A static review of a local Cargo package. No model. Not an audit.

This is a quick static pass over a local Cargo package, useful for catching known issues before you go further. It is not an audit.

```text
/review
```

or, from your shell:

```sh
oms review
```

## What it does

The review is Phase A only, and it uses no model. It captures a snapshot of a local Cargo package and runs offline static tools, `oms-sast` and `cargo-audit`, inside a pinned review-tools container.

| Limit | Value |
|---|---|
| Container network | none |
| Filesystem | read-only |
| Time limit | 300 s |
| Output | capped at 4 MiB |

Reports are private and expire after 30 days. Every report carries a disclaimer that begins "Not a professional audit".

## What it does not do

Phase B and model dispatch are not available, and the review is not a substitute for an audit.

## If it fails

The review tools run in a pinned container, so run `npx @barestate/oms doctor` and read the Docker line. If a report has expired, run the review again.