Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
25 of your 37 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.
Upstream (GitHub) caused delay on this scan — not Repobility.
  • GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
  • Clone from GitHub took 44.79s for a 73.2 MB repo slow.
  • Repobility's analysis ran in 14.13s after the clone landed.

microsoft/terminal

https://github.com/microsoft/terminal · scanned 2026-06-05 06:04 UTC (2 hours, 52 minutes ago) · 10 languages

49 findings (35 legacy + 14 scanner) 11/13 scanners ran Scanner says 97 (lower by 28)

File as issue Image v2 schema
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 hours, 53 minutes ago · v2 · 42 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
87.5
/100
Repobility
78
35 legacy
9-layer
97
77.8% cov · 7 gaps
Critical
0
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 65.0 0.15 9.75
security_score 100.0 0.25 25.00
testing_score 15.0 0.20 3.00
documentation_score 81.0 0.15 12.15
practices_score 79.0 0.15 11.85
code_quality 70.0 0.10 7.00
Overall 1.00 68.8
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 21 Medium 2 Low 6 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 35 9-layer 7 Crowd 0 Layer: Quality 18 Software 20 Api 1 Frontend 1 Security 1 Cicd 1
Scan summary Repository scanned at 97.1/100 with 77.8% coverage. It contains 1585 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 7 findings — concentrated in software (3), api (1), frontend (1). Risk profile is low: 0 critical, 0 high, 2 medium. Recommended next step: open the software layer findings first — that's where the highest-impact wins live.

Showing 28 of 42 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Legacy software dependency conf 0.90 ✓ Repobility [MINED115] Action `actions/add-to-project` pinned to mutable ref `@v1.0.2`: `uses: actions/[email protected]` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate.
Replace with: `uses: actions/add-to-project@<40-char-sha> # v1.0.2` and let Dependabot bump it on a scheduled cadence.
.github/workflows/addToProject.yml:16 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/nuget/nuget.exe` committed in source repo: `dep/nuget/nuget.exe` is a .exe binary (4,596,440 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/nuget/nuget.exe:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/cpprest140_2_8.dll` committed in source repo: `dep/WinAppDriver/cpprest140_2_8.dll` is a .dll binary (4,696,464 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/cpprest140_2_8.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/Microsoft.Win32.Primitives.dll` committed in source repo: `dep/WinAppDriver/Microsoft.Win32.Primitives.dll` is a .dll binary (20,208 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/Microsoft.Win32.Primitives.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/Microsoft.Win32.Registry.dll` committed in source repo: `dep/WinAppDriver/Microsoft.Win32.Registry.dll` is a .dll binary (30,592 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/Microsoft.Win32.Registry.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/MitaBroker.dll` committed in source repo: `dep/WinAppDriver/MitaBroker.dll` is a .dll binary (41,904 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/MitaBroker.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/MitaLite.Foundation.dll` committed in source repo: `dep/WinAppDriver/MitaLite.Foundation.dll` is a .dll binary (296,368 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/MitaLite.Foundation.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/MitaLite.Localization.dll` committed in source repo: `dep/WinAppDriver/MitaLite.Localization.dll` is a .dll binary (22,960 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/MitaLite.Localization.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/MitaLite.UIAutomationAdapter.dll` committed in source repo: `dep/WinAppDriver/MitaLite.UIAutomationAdapter.dll` is a .dll binary (125,872 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/MitaLite.UIAutomationAdapter.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/MitaLite.UIAutomationClient.dll` committed in source repo: `dep/WinAppDriver/MitaLite.UIAutomationClient.dll` is a .dll binary (102,832 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/MitaLite.UIAutomationClient.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/Newtonsoft.Json.dll` committed in source repo: `dep/WinAppDriver/Newtonsoft.Json.dll` is a .dll binary (526,336 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/Newtonsoft.Json.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/System.Diagnostics.Process.dll` committed in source repo: `dep/WinAppDriver/System.Diagnostics.Process.dll` is a .dll binary (37,256 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/System.Diagnostics.Process.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/System.Threading.Thread.dll` committed in source repo: `dep/WinAppDriver/System.Threading.Thread.dll` is a .dll binary (22,240 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/System.Threading.Thread.dll:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/WinAppDriver.exe` committed in source repo: `dep/WinAppDriver/WinAppDriver.exe` is a .exe binary (133,040 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/WinAppDriver.exe:1 dependencylegacy
high Legacy software dependency conf 0.90 ✓ Repobility [MINED134] Binary file `dep/WinAppDriver/WinAppDriverCore.dll` committed in source repo: `dep/WinAppDriver/WinAppDriverCore.dll` is a .dll binary (632,752 bytes) committed to a repo that otherwise has 1194 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.
Audit the binary's provenance. If it's vendored library code, document it in a VENDORED.md. If it's a build artifact, add the extension to .gitignore and rebuild from source.
dep/WinAppDriver/WinAppDriverCore.dll:1 dependencylegacy
high Legacy software xxe conf 1.00 [SEC025] XML External Entity (XXE) — .NET XmlDocument / XmlTextReader: .NET XmlDocument and XmlTextReader expand external entities by default in pre-4.5.2 runtimes (and even later if XmlResolver is left at default). Allows file disclosure and SSRF via XXE.
Set XmlResolver = null on XmlDocument before Load. On XmlReader, pass XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null }. Prefer XDocument / XElement which don't expand external entities by default.
src/tools/ColorTool/ColorTool/SchemeParsers/XmlSchemeParser.cs:135 xxelegacy
high Legacy software xxe conf 1.00 [SEC025] XML External Entity (XXE) — .NET XmlDocument / XmlTextReader: .NET XmlDocument and XmlTextReader expand external entities by default in pre-4.5.2 runtimes (and even later if XmlResolver is left at default). Allows file disclosure and SSRF via XXE.
Set XmlResolver = null on XmlDocument before Load. On XmlReader, pass XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null }. Prefer XDocument / XElement which don't expand external entities by default.
src/tools/ColorTool/ColorTool/SchemeParsers/JsonParser.cs:126 xxelegacy
medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/spelling2.yml supply-chaingithub-actionsleast-privilege
medium 9-layer security coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.
coverageauth
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
src/cascadia/WindowsTerminal/BaseWindow.h:6 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
src/cascadia/TerminalSettingsEditor/Profiles_Base_Orphaned.cpp:15 qualitylegacy
high Legacy quality quality conf 0.86 Duplicated implementation block across source files
Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.
src/cascadia/TerminalControl/TermControlAutomationPeer.cpp:16 qualitylegacy
low Legacy quality quality conf 0.70 Generated build artifact directory is present at repository root
Remove generated output from version control, add it to .gitignore and .dockerignore where relevant, and regenerate it in CI or release jobs.
build:1 qualitylegacy
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/tools/vttests/burrito.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/tools/vttests/template.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: src/tools/vttests/test-unicode.py
Source file with no class/function declarations — possible config, dead code, or scratch file.
dead-code-candidate
low Legacy quality quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
src/terminal/parser/stateMachine.hpp:10 qualitylegacy
low Legacy quality quality conf 1.00 ✓ Repobility [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.
Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context.
src/inc/CppCoreCheck/warnings.h:13 qualitylegacy
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/8ce3c502-c9d3-4106-a87e-1640f4eb89f9/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/8ce3c502-c9d3-4106-a87e-1640f4eb89f9/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.