sqltoolsservice

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

20 of your 62 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 13.56s · analysis 15.52s · 51.6 MB · GitHub API rate-limit (preflight)

https://github.com/microsoft/sqltoolsservice · scanned 2026-06-05 04:15 UTC (4 hours, 55 minutes ago) · 10 languages

118 findings (38 legacy + 80 scanner) 11/13 scanners ran Scanner says 89 (lower by 9)

File as issue Image v2 schema

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 hours, 54 minutes ago · v10 · 46 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	65.0	0.15	9.75
`security_score`	100.0	0.25	25.00
`testing_score`	85.0	0.20	17.00
`documentation_score`	60.0	0.15	9.00
`practices_score`	75.0	0.15	11.25
`code_quality`	80.0	0.10	8.00
Overall		1.00	80.0

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 25 Medium 4 Low 8 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 38 9-layer 8 Crowd 0 Layer: Quality 22 Software 16 Api 1 Data 1 Frontend 1 Cicd 5

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 88.7/100 with 88.9% coverage. It contains 2456 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 8 findings — concentrated in cicd (5), api (1), data (1). Risk profile is low: 0 critical, 0 high, 2 medium. Recommended next step: open the cicd layer findings first — that's where the highest-impact wins live.

Showing 27 of 46 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `mshick/add-pr-comment` pinned to mutable ref `@v3`: `uses: mshick/add-pr-comment@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.

Replace with: `uses: mshick/add-pr-comment@<40-char-sha> # v3` and let Dependabot bump it on a scheduled cadence.

.github/workflows/packages-validation-comment.yml:15 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/Castle.Core.dll` committed in source repo: `bin/ref/Castle.Core.dll` is a .dll binary (264,192 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/Castle.Core.dll:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/Moq.dll` committed in source repo: `bin/ref/Moq.dll` is a .dll binary (168,960 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/Moq.dll:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/Newtonsoft.Json.dll` committed in source repo: `bin/ref/Newtonsoft.Json.dll` is a .dll binary (636,416 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/Newtonsoft.Json.dll:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/Scriptoria.dll` committed in source repo: `bin/ref/Scriptoria.dll` is a .dll binary (229,408 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/Scriptoria.dll:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/ScriptoriaCommonDefs.dll` committed in source repo: `bin/ref/ScriptoriaCommonDefs.dll` is a .dll binary (29,208 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/ScriptoriaCommonDefs.dll:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/SqlCopilotCommon.dll` committed in source repo: `bin/ref/SqlCopilotCommon.dll` is a .dll binary (25,120 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/SqlCopilotCommon.dll:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/SqlScriptoria.dll` committed in source repo: `bin/ref/SqlScriptoria.dll` is a .dll binary (707,104 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/SqlScriptoria.dll:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/SqlScriptoriaCommon.dll` committed in source repo: `bin/ref/SqlScriptoriaCommon.dll` is a .dll binary (16,928 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/SqlScriptoriaCommon.dll:1 dependencylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `bin/ref/YamlDotNet.dll` committed in source repo: `bin/ref/YamlDotNet.dll` is a .dll binary (287,264 bytes) committed to a repo that otherwise has 1647 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.

Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.

bin/ref/YamlDotNet.dll:1 dependencylegacy

medium Legacy quality quality conf 1.00 [SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws — wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated.

Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows.

src/Microsoft.SqlTools.SqlCore/SchemaCompare/SchemaCompareUtils.cs:100 qualitylegacy

high Legacy quality quality conf 0.82 Parallel implementation file sits beside a canonical file

Merge the intended change into the canonical file, update tests/imports, and delete the parallel implementation if it is not the active entry point.

src/Microsoft.SqlTools.Credentials/Credentials/OSX/Interop.Security.old.cs:1 qualitylegacy

medium Legacy quality quality conf 0.78 Suspicious implementation file appears unreferenced

Confirm whether this file is reachable. If not, delete it; if yes, wire it through explicit imports, routes, or entry points and add a test that proves the path executes.

src/Microsoft.SqlTools.Credentials/Credentials/OSX/Interop.Security.old.cs:1 qualitylegacy

medium 9-layer data coverage conf 1.00 ORM models found but no DB engine detected

The repo defines tables/models but no DB connection string was found. Likely lives in env vars or a config file the scanner didn't read.

coverage

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

src/Microsoft.SqlTools.ServiceLayer/AutoParameterizaition/Exceptions/ParameterizationFormatException.cs:37 qualitylegacy

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

docs/samples/smo/netcore/ModifySetting/Program.cs:23 qualitylegacy

low Legacy quality quality conf 0.64 Duplicate top-level symbol appears in a patch-style file

Keep one authoritative implementation, update imports to point at it, and remove or rename the duplicate symbol.

src/Microsoft.SqlTools.Credentials/Credentials/OSX/Interop.Security.old.cs:1 qualitylegacy