Borehole · Project · free tier
jandedobbeleer/oh-my-posh
Free reading: not for reliance
0b9da69 · 5,559 commits · 1,186 files
Read 2026-11-07

jandedobbeleer/oh-my-posh: technical due diligence, read from its repository

What Borehole read in jandedobbeleer/oh-my-posh's code and history at 0b9da69: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

DimensionRating
Architecture & Codebase — including AI provenancestrong
Engineering Process & SDLC Maturitystrong
Product & Engineering Maturitystrong
Security & Reliability Postureadequate
Observability & Operationsnot assessable
Fit with the Acquirernot assessable

What the repository says

  • COPYING: Relicensed: GPL-3.0 → MIT (2022-02-28)

Architecture & Codebase — including AI provenance

strong
01.6

src/segments/git.go is 1,650 lines, 17× this codebase's median file

adequate

The median source file here is 95 lines. 4 files exceed 1,000 lines, the largest being 1,650. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence
src/segments/git.go:1 — 1,650 lines (17× median)
src/terminal/writer.go:1 — 1,647 lines (17× median)
src/segments/path.go:1 — 1,082 lines (11× median)
src/config/segment.go:1 — 1,014 lines (10× median)

Engineering Process & SDLC Maturity

strong

No finding.

Product & Engineering Maturity

strong

No finding.

Security & Reliability Posture

adequate
05.1

2 credential-shaped strings in the tree sit in tests, examples, documentation or local development settings

adequate

Strings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key.

Evidence
2 cited: AWS access key, where fakes are usual
05.27

The build runs third-party code it does not pin

adequate

6 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.

Evidence
.github/workflows/bluesky.yml:12 — action pinned by tag
.github/workflows/commits.yml:11 — action pinned by tag
05.26

41 locked dependencies have published vulnerabilities, 47 high or critical in what ships

adequate

41 of 1,242 locked dependencies match 135 published advisories in OSV, 66 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version.

Evidence
website/api/package-lock.json — proxy-addr 2.0.7: GHSA-jqcg-44mw-7w3h (critical), fixed in 2.0.8
website/package-lock.json — tinypool 1.1.1: GHSA-5gmw-xhrv-c9v3 (critical), fixed in 2.1.1; reached only by the build
website/api/package-lock.json — @modelcontextprotocol/sdk 1.26.0: GHSA-22jm-h49p-29qw (high), fixed in 1.32.0
05.48

10 places insert HTML from a variable without sanitising it

adequate

10 places set HTML from a value that is neither a literal nor passed through a sanitiser. Where the value can come from a user, that is stored cross-site scripting, and it is the first thing a buyer's security review looks for in a frontend.

Evidence
website/src/components/Config.js:298 — HTML from a variable
website/src/components/Config.js:304 — HTML from a variable
website/src/components/Config.js:308 — HTML from a variable
05.60

Relicensed: GPL-3.0 → MIT (2022-02-28)

adequate

The root licence changed 1 time(s). Code taken under earlier terms stays under them; check which terms any fork or customer relied on.

Evidence
COPYING — GPL-3.0 from 2020-09-12
COPYING — MIT from 2022-02-28
05.65

2 advisories against this project in the last 24 months, 1 high or critical

adequate

The newest was published on 2026-07-23. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. None of them affects the surveyed version.

Evidence
2026-07-23: GHSA-fwjx-9p69-h25h (moderate), fixed in 29.35.1: Terminal escape sequence injection via unsanitized prompt segment data
2026-07-23: GHSA-6xj8-qv9j-xcjq (high), fixed in 29.35.1: Arbitrary command execution via template injection in the path segment

Observability & Operations

not assessable

Not rated: only 4 of 16 checks could reach a conclusion here; the rest do not apply to this repository or could not read it.

Fit with the Acquirer

not assessable

Not rated: structurally not assessable from a repository.

Read more, or read your own

The full report on jandedobbeleer/oh-my-posh: every dimension, the questions for the room, and the audit log.

Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.