rustls 0.23.40 is a #![no_std], #![forbid(unsafe_code)] TLS 1.2/1.3 library; published source is byte-identical to VCS. No unsafe, no FFI, no I/O beyond opt-in SSLKEYLOGFILE. Record-layer sequence limits, oversized-record rejection, and the RFC 8446 downgrade sentinel are present. Crypto primitives and cert validation are delegated to the provider and rustls-webpki (scoped out). No findings.