Ghost reads Rust, and a scan that confirmed nothing has no score

Cargo's build output and Cargo.lock are still skipped, and benches/ counts as test code alongside tests/ and examples/.

On the Scan Queue, a wait that cannot be estimated now says est. unknown on its row, and the reason is said once under the table instead of on every row.

A finding that says a file never uses something, when that file does use it, is now set aside with the lines that use it, and so is one titled "Unused X class" when X is used. Code in a demo folder counts as example code. When verification removes every finding, the closing risk section says so instead of describing what was removed.

Times in the scan log no longer read 60 seconds past a minute, and a call another machine answered is counted once, under the model that answered it.

A scripted CLI scan that waits in the queue now says where it is in line, and the backup emails name the scans they paused and resumed.

A scan whose findings were all removed, or one cut off before it finished, no longer shows 100/100 on any surface. Test fixture keys are no longer mistaken for secrets, a finding in a named function points inside it, and scripted-scan flags without --no-interactive say so.

A password in a development-only settings file, such as appsettings.Development.json or .env.development, is now rated like one in test code instead of CRITICAL.

A finding that calls a catch block silent is set aside when the catch rethrows or logs the exception, or is the catch of a test that expects the exception; one that says a method is never invoked is set aside when the code calls it.

The usage report says "none confirmed" rather than "none found" when a scan raised findings it could not confirm, names how many were set aside or removed, and says which period it covers.

EJ Wisner, founder of Ghost Architect™. Local pricing is monthly, per team size, with no per-token bill; the numbers are on the pricing page.