SECURITY.md claims the bincode advisory ignore was removed and the dep is gone — both are false #68

Task

SECURITY.md states that a dependency was removed and its advisory ignore withdrawn. Both halves are
false, and have been for some time. Correct the document to match the tree, or remove the claim.

The claim

SECURITY.md:209-210:

bincode 1.x advisory (RUSTSEC-2025-0141) ignore has been removed: bincode
is no longer in the dependency tree. Re-evaluate each audit.

What is actually true, measured 2026-09-06 on main

The ignore is also genuinely still needed — cargo-deny does not report it as an unmatched
advisory-not-detected, unlike RUSTSEC-2024-0388 and RUSTSEC-2025-0055, which were removed as
stale in #67 precisely because it did flag those.

Why this is worth a ticket rather than a comment

A SECURITY.md is the document someone reads to decide what has been audited and what is
outstanding. A reader following this entry concludes that a suppression is gone and the dependency
with it, and would not think to check deny.toml — which is the one place that would have told them
otherwise. A false statement here is load-bearing in a way the same sentence in a README would not be.

It is also cheap to get wrong again: the entry reads like a completed remediation, and completed
remediations are exactly what nobody re-reads.

Acceptance

• SECURITY.md describes the actual state: the ignore is present, still required, and why.
• If the intent was to remove the dependency and that work is still wanted, say so as an open item
  rather than a closed one — and file it separately; this ticket is about the document telling the
  truth, not about removing bincode.
• Grep the rest of SECURITY.md for the same shape while you are in there: a closed-item entry whose
  subject shipped or changed afterwards. Report what you find even if you fix nothing else.

Context

Found during #67 (the wasmtime RUSTSEC-2026-0268/-0269 unblock, merged at 0.29.5), which
removed two genuinely stale ignores and left this one in place — correctly.

Parent: https://github.com/DIG-Network/dig_ecosystem/issues/3175 (make a normative MUST mechanically
checkable — the born-false-claim family).