50 Rust Rules Every Specialist Should Follow

A master checklist across safety, API design, async, performance, and tooling. Use in reviews and onboarding.

How to Use This List

• Skim all 50 once, then deep-dive linked articles per gap.
• Tick rules your team enforces in CI or CONTRIBUTING.md.
• Revisit after toolchain or edition upgrades.

Safety and Correctness (1-10)

1. Minimize unsafe scope - isolate in small modules with # Safety docs.
2. Never unwrap in library public API - return Result.
3. Use ? for error propagation - avoid nested match noise.
4. Prefer try_from over lossy as casts - especially user input.
5. Run Miri/tests on unsafe code - catch UB in CI when feasible.
6. Deny unsafe_code in domain crates - single FFI crate exception documented.
7. Avoid panic! for control flow - use Result or Option.
8. Validate invariants in constructors - illegal states unconstructable.
9. Use checked_add for user-influenced arithmetic - or widen types.
10. Treat #[deny(warnings)] seriously on toolchain bumps - fix, do not silence globally.

Ownership and Types (11-20)

11. Newtype domain IDs - UserId not bare u64.
12. Borrow before clone - profile clones in hot paths.
13. Prefer &str over String in arguments - take impl AsRef<str> when flexible.
14. Use Cow at boundaries - borrow when possible, own when needed.
15. Enums over bool pairs - enum State { Draft, Live } not two bools.
16. Typestate for critical protocols - when illegal transitions are costly.
17. Implement From/TryFrom - standard conversion traits.
18. RAII for resources - files, locks, guards.
19. Avoid Rc<RefCell> webs - redesign with ownership or channels.
20. Document Send/Sync requirements - especially for generic bounds.

Async and Concurrency (21-30)

21. Do not block Tokio workers - spawn_blocking for sync I/O.
22. Use tokio::sync::Mutex in async - not std::sync::Mutex across await.
23. Timeout external calls - tokio::time::timeout.
24. Bound concurrency - semaphores on fan-out.
25. Understand Send bounds on spawned tasks - 'static + Send.
26. Graceful shutdown - signal + drain tasks.
27. Channels for work distribution - backpressure aware.
28. Atomics with correct ordering - not SeqCst by default everywhere.
29. Avoid shared mutable globals - OnceLock config instead.
30. Test async with #[tokio::test] - fake time with pause.

Performance and Build (31-40)

31. Measure release builds - profile before optimizing.
32. Thin LTO for production - tune with data.
33. Disable unused crate features - faster builds, smaller binaries.
34. Commit Cargo.lock for apps - reproducible deploys.
35. Use cargo clippy -D warnings - in CI.
36. Use cargo fmt --check - zero style debate.
37. Criterion for hot path regressions - not guesswork.
38. Avoid alloc in inner loops - reuse buffers.
39. Prefer iterators until proven slow - zero-cost abstractions.
40. Right-size connection pools - sqlx pool from load tests.

API, Errors, and Ecosystem (41-50)

41. Follow Rust API Guidelines naming - as_, to_, into_ conventions.
42. thiserror in libraries, anyhow in binaries - workspace policy.
43. Structured errors with context - error.source() chain.
44. Serde with #[serde(deny_unknown_fields)] on external input - when safe.
45. Feature flags documented - README examples.
46. cargo audit on schedule - supply chain hygiene.
47. Doctests on public examples - docs stay honest.
48. Integration tests on public API - not only private unit tests.
49. ADR for architecture forks - record tradeoffs.
50. Prefer std and well-maintained crates - audit before adding deps.

FAQs

Related

• Rust API Guidelines
• 30 Async Rules
• 30 Unsafe Rules
• Rust Patterns Best Practices

Stack versions: This page was written for Rust 1.97.0 (edition 2024), Tokio 1.x, Axum 0.8, serde 1.0, sqlx 0.8, clap 4, and Polars 0.46+.