Skip to content

Scoring

How the score is computed, what it ranks first, and when it is authoritative.

Rust Doctor scores five dimensions independently, then takes a weighted average from 0 to 100.

#Distinct rules, not occurrences

A dimension loses points once per distinct rule violated. Repeating the same rule across fifty locations raises the finding count and leaves the penalty where it was.

SeverityPenalty per distinct rule
Error1.5
Warning0.75
Info0.25

That is what keeps the score invariant to codebase size: a large project is not penalized for being large, and fixing every occurrence of one issue removes that penalty entirely rather than shaving it.

#Dimensions and weights

DimensionWeightCategories that feed itRules
Security2.0security6
Reliability1.5correctness, reliability25
Maintainability1.0maintainability16
Performance1.0performance10
Dependencies1.0dependencies5

Each dimension starts at 100, subtracts its penalties, and is clamped to [0, 100]. The overall score is their weighted average over a total weight of 6.5.

#What it tells you to fix first

The report ends with three rules, and they are not the three most frequent. Each rule is ranked by what repairing it is expected to be worth: what it currently costs the score, discounted by the rate at which that rule was measured wrong on healthy public code.

A rule whose expected value comes out at zero is left out of the ranking rather than listed last, because naming it would still be telling you to go and change something. When a rule is withheld for measured noise, the report says so: a rule that is loud in your codebase and absent from the list of what to fix has to be legible without recomputing anything.

The noise rate only ranks. It never reduces what a rule costs the score: what a rule costs is what it reported.

#Authority

A score is published as authoritative only when the scan completed and every pass produced trustworthy diagnostics. If a pass fails, the report carries the failure at its stage and drops the flag rather than presenting a number that quietly means less.

A non-authoritative score prints no share link, and the report names no top three, since ranking what to fix first from an incomplete scan would be guessing.