I'm interested in setting up https://github.com/RustSec/cargo-audit but I'm not sure where to. CI is the obvious place, but the results may not be consistent if vulnerabilities are found in existing dependencies... Any thoughts?