A Gap Is a Finding, Not a Silent Zero
Most scanners return 'no findings' whether your code is clean or the tool simply could not analyze it. Those are opposite facts wearing the same output. We rebuilt so the tool tells you which one you are looking at, and grades its own work on every run.
There are two ways a scanner can hand you an empty report. Your code is clean, or the scanner could not read it. Most tools spell both the same way: no findings. That silence is one of the most dangerous outputs in security tooling, because it looks exactly like safety.
Absence is a claim
When our engine cannot analyze something, a language construct it does not yet model, a framework it has not learned, a file it could not resolve, it now says so. The gap is reported as a finding, with the reason and the place, instead of being rounded down to zero. A coverage gap you can see is a task. A coverage gap you cannot see is a false sense of security with your name on the sign-off.
This sounds obvious. It is not how most tools behave, because reporting your own blind spots is the opposite of a good demo. We think a tool that hides its blind spots has not earned the clean report it hands you.
The scanner grades itself
The second half is that every run checks its own work before it trusts it. The engine reconciles what each stage produced against what the next stage received, and when they disagree, the run fails loudly instead of publishing a number built on a gap.
We know this matters because it caught us. During the rebuild the tool flagged that it was running two of its most expensive checks and then throwing the result away, and separately that a whole class of its self-tests had never actually executed. Both were invisible from the outside. The output looked fine. The self-audit is the only reason we found them, and the fix went into the tool, never into the check that exposed it.
Why this is the spine, not a feature
A finding is only worth acting on if you can trust the process that produced it. Everything that consumes a clean report inherits its blind spots: the pull request that merges on a green check, the compliance box that gets ticked, the model that learns your code is safe because nothing came back. A scanner that refuses to fake a clean result, and refuses to trust its own output unchecked, is the only kind whose silence means anything.
Honest scope note
This does not mean the engine covers everything. It means that where it does not, you will know, by name, instead of guessing. That is a deliberate trade against a prettier empty report. Correctness here answers to an outside yardstick: BenchProctor scores the findings on a benchmark whose answer key we do not control, so “accurate” stays a measured number rather than our adjective.
TheAuditor is in final commercial release preparation and ships when its checks pass, not before. Subscribe on the main site for launch news.
Was this useful?