How to harden Rust servers?

Your daily reminder that, while Rust's safe APIs are memory-safe, that doesn't extend to /proc/self/mem and so, if there is a path traversal to that, secrets could still leak. So, what hardening approaches are there for Rust? I typically use axum, but would be glad to hear about any framework. If the approach is #[!forbid(unsafe_code)][1], even better. I use that attribute for code that requires superuser rights, for instance ↩︎