improved output and security fix for when there's no wildcard