Crate removal procedure

Status 2020-01-21: this document is incomplete and unvetted. We anticipate to be receiving guidelines from Mozilla Legal in the near future. If this notice is still here on 2020-03-21, please comment on this issue asking for a status update.

If we get a DMCA takedown notice, here's what needs to happen:

Remove relevant version(s) and/or entire crates from

  • Remove it from the database:

    heroku run -- cargo run --bin delete-crate [crate-name]


    heroku run -- cargo run --bin delete-version [crate-name] [version-number]
  • Remove the crate or version from the index. To remove an entire crate, remove the entire crate file. For a version, remove the line corresponding to the relevant version.

  • Remove the crate archive(s) and readme file(s) from S3.

  • Invalidate the CloudFront cache – remove both the relevant readme and crate files. If in doubt, invalidate /* to flush everything.

Remove entire crates from

The application supports deleting all the documentation ever published of a crate, by running a CLI command. The people who currently have permissions to access the server and run it are:

You can find the documentation on how to run the command here.