I thought I'd note that cargo-audit uses the home crate to obtain cargo_home() from which it constructs e.g. ~/.cargo/advisory-db as a cache of the advisory DB to scan against. However, it seems like we should have no trouble migrating to e.g. cargo_data_home() in future releases.