Sadly Rust does little to deal with these higher-level bugs. We give you tools to deal with them (tracking taint with PhantomData), but it's not clear to me tha

Sadly Rust does little to deal with these higher-level bugs. We give you tools to deal with them (tracking taint with PhantomData), but it's not clear to me that anyone's bothering to actually do that. e.g. crates.io does no such tracking, but it also just punts the problem completely to our postgres bindings and making sure to build queries separately from their args (and the postgres arg injection does escaping, presumably). But this is no static or novel guarantee. It's just Alex being a great developer and reviewing all the patches. I wouldn't be floored if crates.io was exploitable. Actually I know it is; [I've exploited it](https://github.com/rust-lang/crates.io/issues/176 https://github.com/rust-lang/crates.io/issues/176). Rust solves many interesting problems, but it is no panacea for program correctness!