diff --git a/fwdctl/Cargo.toml b/fwdctl/Cargo.toml
index 1236f9ce1..e91ccf120 100644
--- a/fwdctl/Cargo.toml
+++ b/fwdctl/Cargo.toml
@@ -16,3 +16,12 @@ futures-util = "0.3.29"
 assert_cmd = "2.0.7"
 predicates = "3.0.1"
 serial_test = "2.0.0"
+
+[lints.rust]
+unsafe_code = "deny"
+
+[lints.clippy]
+unwrap_used = "warn"
+indexing_slicing = "warn"
+explicit_deref_methods = "warn"
+missing_const_for_fn = "warn"
diff --git a/fwdctl/src/create.rs b/fwdctl/src/create.rs
index d52ed1127..51d3ed251 100644
--- a/fwdctl/src/create.rs
+++ b/fwdctl/src/create.rs
@@ -245,7 +245,7 @@ pub struct Options {
     max_revisions: u32,
 }
 
-pub fn initialize_db_config(opts: &Options) -> DbConfig {
+pub(super) const fn initialize_db_config(opts: &Options) -> DbConfig {
     DbConfig {
         meta_ncached_pages: opts.meta_ncached_pages,
         meta_ncached_files: opts.meta_ncached_files,
@@ -279,7 +279,7 @@ pub fn initialize_db_config(opts: &Options) -> DbConfig {
     }
 }
 
-pub async fn run(opts: &Options) -> Result<(), api::Error> {
+pub(super) async fn run(opts: &Options) -> Result<(), api::Error> {
     let db_config = initialize_db_config(opts);
     log::debug!("database configuration parameters: \n{:?}\n", db_config);
 
diff --git a/fwdctl/src/delete.rs b/fwdctl/src/delete.rs
index 50bba1b29..c47f5a9b4 100644
--- a/fwdctl/src/delete.rs
+++ b/fwdctl/src/delete.rs
@@ -27,7 +27,7 @@ pub struct Options {
     pub db: String,
 }
 
-pub async fn run(opts: &Options) -> Result<(), api::Error> {
+pub(super) async fn run(opts: &Options) -> Result<(), api::Error> {
     log::debug!("deleting key {:?}", opts);
     let cfg = DbConfig::builder()
         .truncate(false)
diff --git a/fwdctl/src/dump.rs b/fwdctl/src/dump.rs
index 9320943de..3ae12358a 100644
--- a/fwdctl/src/dump.rs
+++ b/fwdctl/src/dump.rs
@@ -23,7 +23,7 @@ pub struct Options {
     pub db: String,
 }
 
-pub async fn run(opts: &Options) -> Result<(), api::Error> {
+pub(super) async fn run(opts: &Options) -> Result<(), api::Error> {
     log::debug!("dump database {:?}", opts);
     let cfg = DbConfig::builder()
         .truncate(false)
@@ -37,7 +37,7 @@ pub async fn run(opts: &Options) -> Result<(), api::Error> {
         match stream.next().await {
             None => break,
             Some(Ok((key, value))) => {
-                println!("'{}': '{}'", u8_to_string(&key), u8_to_string(&value))
+                println!("'{}': '{}'", u8_to_string(&key), u8_to_string(&value));
             }
             Some(Err(e)) => return Err(e),
         }
diff --git a/fwdctl/src/get.rs b/fwdctl/src/get.rs
index 6a637ac4d..a94c437d1 100644
--- a/fwdctl/src/get.rs
+++ b/fwdctl/src/get.rs
@@ -26,7 +26,7 @@ pub struct Options {
     pub db: String,
 }
 
-pub async fn run(opts: &Options) -> Result<(), api::Error> {
+pub(super) async fn run(opts: &Options) -> Result<(), api::Error> {
     log::debug!("get key value pair {:?}", opts);
     let cfg = DbConfig::builder()
         .truncate(false)
@@ -39,7 +39,7 @@ pub async fn run(opts: &Options) -> Result<(), api::Error> {
     match rev.val(opts.key.as_bytes()).await {
         Ok(Some(val)) => {
             let s = String::from_utf8_lossy(val.as_ref());
-            println!("{:?}", s);
+            println!("{s:?}");
             Ok(())
         }
         Ok(None) => {
diff --git a/fwdctl/src/insert.rs b/fwdctl/src/insert.rs
index 84e6ef2b7..8cb56b8f7 100644
--- a/fwdctl/src/insert.rs
+++ b/fwdctl/src/insert.rs
@@ -31,7 +31,7 @@ pub struct Options {
     pub db: String,
 }
 
-pub async fn run(opts: &Options) -> Result<(), api::Error> {
+pub(super) async fn run(opts: &Options) -> Result<(), api::Error> {
     log::debug!("inserting key value pair {:?}", opts);
     let cfg = DbConfig::builder()
         .truncate(false)
diff --git a/fwdctl/src/root.rs b/fwdctl/src/root.rs
index 119a6b463..973d44616 100644
--- a/fwdctl/src/root.rs
+++ b/fwdctl/src/root.rs
@@ -23,7 +23,7 @@ pub struct Options {
     pub db: String,
 }
 
-pub async fn run(opts: &Options) -> Result<(), api::Error> {
+pub(super) async fn run(opts: &Options) -> Result<(), api::Error> {
     log::debug!("root hash {:?}", opts);
     let cfg = DbConfig::builder()
         .truncate(false)
@@ -32,6 +32,6 @@ pub async fn run(opts: &Options) -> Result<(), api::Error> {
     let db = Db::new(opts.db.clone(), &cfg.build()).await?;
 
     let root = db.root_hash().await?;
-    println!("{:X?}", root);
+    println!("{root:X?}");
     Ok(())
 }