undocumented-unsafe

Require a safety rationale for every unsafe declaration and expression

Unsafe callables impose obligations on their callers, while unsafe implementations and local regions rely on invariants the checker cannot verify.
Instead, you SHOULD document caller obligations under # Safety and justify implementations and local regions with an immediately preceding SAFETY: comment or a nonempty @unsafe reason.

- Category: security
- Level: warning
- Fix: none
- Scope: module

Reported

function execute(): void {
    @unsafe
    {}
}
Accepted

function execute(): void {
    // SAFETY: no unsafe operation escapes this region
    @unsafe
    {}
}
Prior art

- Clippy · missingsafetydoc
- Clippy · undocumentedunsafeblocks

language/linter/src/rules/security/undocumentedunsafe.rs:7