WinMerge is an Open Source differencing and merging tool for Windows. WinMerge can compare both folders and files, presenting differences in a visual text format that is easy to understand and handle.
This report summarizes scanner evidence for WinMerge/winmerge, a C++ project with 9,256 GitHub stars. SynthScan examined 1,204,863 lines of code across 5399 source files, recording 11844 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 8.2 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 11799 finding(s).
Are imports declared and package/API names verified? 11 finding(s).
Are wrappers, guards, and repeated structures necessary? 38 finding(s).
Which changes need focused human review? 11844 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 11844 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Version.h | 1 | #define FILEVER 2,16,59,0 | COMMENT |
| LOW | ShellExtension/ShellExtension/StdAfx.h | 1 | // stdafx.h : include file for standard system include files, | COMMENT |
| LOW | ShellExtension/ShellExtension/WinMergeShell.cpp | 1 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | ShellExtension/ShellExtension/WinMergeShell.cpp | 21 | // HKEY_CURRENT_USER\Software\Thingamahoochie\WinMerge\ContextMenuEnabled | COMMENT |
| LOW | ShellExtension/ShellExtension/WinMergeShell.cpp | 41 | #include "ShellExtension.h" | COMMENT |
| LOW | ShellExtension/ShellExtension/WinMergeShell.h | 1 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | ShellExtension/ShellExtension/Resource.h | 1 | //{{NO_DEPENDENCIES}} | COMMENT |
| LOW | ShellExtension/ShellExtension/Resource.h | 21 | #define _APS_NEXT_RESOURCE_VALUE 210 | COMMENT |
| LOW | ShellExtension/ShellExtension/StdAfx.cpp | 1 | // stdafx.cpp : source file that includes just the standard includes | COMMENT |
| LOW | ShellExtension/ShellExtension/ShellExtension.cpp | 1 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | ShellExtension/WinMergeContextMenu/pch.h | 1 | // pch.h: This is a precompiled header file. | COMMENT |
| LOW | ShellExtension/WinMergeContextMenu/dllmain.cpp | 1 | // SPDX-License-Identifier: MIT | COMMENT |
| LOW | ShellExtension/WinMergeContextMenu/resource.h | 1 | //{{NO_DEPENDENCIES}} | COMMENT |
| LOW | ShellExtension/WinMergeContextMenu/resource.h | 21 | #define _APS_NEXT_RESOURCE_VALUE 210 | COMMENT |
| LOW | ShellExtension/WinMergeContextMenu/framework.h | 1 | #pragma once | COMMENT |
| LOW | ShellExtension/Common/UnicodeString.cpp | 1 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | ShellExtension/Common/WinMergeContextMenu.cpp | 1 | #include "WinMergeContextMenu.h" | COMMENT |
| LOW | ShellExtension/Common/UnicodeString.h | 1 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | ShellExtension/Common/UnicodeString.h | 21 | * @brief Unicode string based on std::wstring. | COMMENT |
| LOW | ShellExtension/Common/UnicodeString.h | 41 | # ifdef _UNICODE | COMMENT |
| LOW | Plugins/resource.h | 1 | //{{NO_DEPENDENCIES}} | COMMENT |
| LOW | Plugins/resource.h | 21 | #define IDS_PLUGIN_MENU_CAPTION6 44216 | COMMENT |
| LOW | Plugins/resource.h | 41 | #define IDS_PLUGIN_MENU_CAPTION26 44236 | COMMENT |
| LOW | Plugins/resource.h | 61 | #define IDS_PLUGIN_DESCRIPTION6 44356 | COMMENT |
| LOW | Plugins/resource.h | 81 | #define IDS_PLUGIN_DESCRIPTION26 44376 | COMMENT |
| LOW | Plugins/resource.h | 101 | #define IDS_PLUGIN_DESCRIPTION46 44396 | COMMENT |
| LOW | Plugins/resource.h | 121 | #define IDS_PLUGIN_COMPAREMSEXCELFILES_STR6 44425 | COMMENT |
| LOW | Plugins/resource.h | 141 | #define IDS_PLUGIN_COMPAREMSWORDFILES_STR6 44445 | COMMENT |
| LOW | Plugins/resource.h | 161 | #define IDS_PLUGIN_COMPAREMSPOWERPOINTFILES_STR6 44465 | COMMENT |
| LOW | Plugins/resource.h | 181 | #define IDS_PLUGIN_COMPAREMSVISIOFILES_STR6 44485 | COMMENT |
| LOW | Plugins/resource.h | 201 | #define IDS_PLUGIN_PREDIFFLINEFILTER_STR6 44505 | COMMENT |
| LOW | Plugins/resource.h | 221 | #define IDS_PLUGIN_IGNORE_STR6 44525 | COMMENT |
| LOW | Plugins/resource.h | 241 | #define IDS_PLUGIN_APPLYPATCH_STR6 44545 | COMMENT |
| LOW | Plugins/resource.h | 261 | #define IDS_PLUGIN_EDITORADDIN_STR6 44565 | COMMENT |
| LOW | Plugins/resource.h | 281 | #define _APS_NO_MFC 1 | COMMENT |
| LOW | Plugins/src_VCPP/DisplayXMLFiles/StdAfx.h | 1 | // stdafx.h : include file for standard system include files, | COMMENT |
| LOW | Plugins/src_VCPP/DisplayXMLFiles/WinMergeScript.cpp | 1 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | Plugins/src_VCPP/DisplayXMLFiles/typeinfoex.h | 1 | #ifndef _NEWOBJECTS_ATL_TYPEINFOEX_H_ | COMMENT |
| LOW | Plugins/src_VCPP/DisplayXMLFiles/Resource.h | 1 | //{{NO_DEPENDENCIES}} | COMMENT |
| LOW | Plugins/src_VCPP/DisplayXMLFiles/StdAfx.cpp | 1 | // stdafx.cpp : source file that includes just the standard includes | COMMENT |
| LOW | …ns/src_VCPP/DisplayXMLFiles/ExpatMapLib/expat_maps.cpp | 1 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | …ns/src_VCPP/DisplayXMLFiles/ExpatMapLib/expat_maps.cpp | 21 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | …ns/src_VCPP/DisplayXMLFiles/ExpatMapLib/expat_maps.cpp | 41 | #include "map_data_8859_11.h" | COMMENT |
| LOW | Plugins/src_VCPP/DisplayXMLFiles/ExpatMapLib/StdAfx.h | 1 | // stdafx.h : include file for standard system include files, | COMMENT |
| LOW | …gins/src_VCPP/DisplayXMLFiles/ExpatMapLib/expat_maps.h | 1 | ///////////////////////////////////////////////////////////////////////////// | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1252.TXT | 1 | # | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1253.TXT | 1 | # | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1251.TXT | 1 | # | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1250.TXT | 1 | # | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1254.TXT | 1 | # | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1255.TXT | 1 | # | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1257.TXT | 1 | # | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1256.TXT | 1 | # | COMMENT |
| LOW | …ExpatMapLib/mappings/VENDORS/MICSFT/WINDOWS/CP1258.TXT | 1 | # | COMMENT |
| LOW | …splayXMLFiles/ExpatMapLib/mappings/ISO8859/8859-10.TXT | 1 | # | COMMENT |
| LOW | …splayXMLFiles/ExpatMapLib/mappings/ISO8859/8859-10.TXT | 21 | # Unicode Standard, and to make copies of this file in any form for | COMMENT |
| LOW | …isplayXMLFiles/ExpatMapLib/mappings/ISO8859/8859-9.TXT | 1 | # | COMMENT |
| LOW | …isplayXMLFiles/ExpatMapLib/mappings/ISO8859/8859-9.TXT | 21 | # Unicode Standard, and to make copies of this file in any form for | COMMENT |
| LOW | …isplayXMLFiles/ExpatMapLib/mappings/ISO8859/8859-8.TXT | 1 | # | COMMENT |
| LOW | …isplayXMLFiles/ExpatMapLib/mappings/ISO8859/8859-8.TXT | 21 | # Unicode Standard, and to make copies of this file in any form for | COMMENT |
| 11703 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | Docs/Developers/doxygen.cfg | 1149 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | Docs/Developers/doxygen.cfg | 1151 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | Docs/Developers/doxygen.cfg | 1161 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | Docs/Developers/doxygen.cfg | 1163 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 13 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 15 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 291 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 293 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 506 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 508 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 557 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 559 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 673 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 675 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 728 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 730 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 751 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 753 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 968 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 970 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1044 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1046 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1086 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1088 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1114 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1116 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1194 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1196 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1260 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1262 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1303 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1305 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1497 | #--------------------------------------------------------------------------- | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 1499 | #--------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | Externals/poco/XML/include/Poco/DOM/DOMImplementation.h | 38 | /// In this implementation, DOMImplementation is implemented as a singleton. | COMMENT |
| HIGH | Externals/poco/XML/include/Poco/DOM/DocumentType.h | 51 | /// Note: In this implementation, only the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Docs/Developers/doxygen.cfg | 578 | # If the value of the INPUT tag contains directories, you can use the | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 605 | # If the value of the INPUT tag contains directories, you can use the | COMMENT |
| MEDIUM | Docs/Developers/doxygen.cfg | 628 | # If the value of the EXAMPLE_PATH tag contains directories, you can use the | COMMENT |
| MEDIUM | Docs/Developers/UnitTesting.html | 122 | <p>As mentioned earlier Google Test header files are needed to compile the | CODE |
| LOW | Src/Common/sizecbar.cpp | 36 | // Modify this file only to fix bugs, and don't forget to send me a copy. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | Src/RenameMoveDetection.cpp | 246 | // Step 1: Quick win - group items by same name | COMMENT |
| LOW⚡ | Src/RenameMoveDetection.cpp | 250 | // Step 2: Collect unmatched items grouped by rename/move detection keys | COMMENT |
| LOW⚡ | Src/RenameMoveDetection.cpp | 260 | // Step 3: Create groups for items with matching keys | COMMENT |
| LOW⚡ | Src/RenameMoveDetection.cpp | 264 | // Step 4: Recurse into subdirectories that exist on all sides | COMMENT |
| LOW | Src/RenameMoveDetection.cpp | 276 | // Step 5: Recurse into renamed directories | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | Src/RenameMoveDetection.cpp | 246 | // Step 1: Quick win - group items by same name | COMMENT |
| LOW⚡ | Src/RenameMoveDetection.cpp | 250 | // Step 2: Collect unmatched items grouped by rename/move detection keys | COMMENT |
| LOW⚡ | Src/RenameMoveDetection.cpp | 260 | // Step 3: Create groups for items with matching keys | COMMENT |
| LOW⚡ | Src/RenameMoveDetection.cpp | 264 | // Step 4: Recurse into subdirectories that exist on all sides | COMMENT |
| LOW | Src/RenameMoveDetection.cpp | 276 | // Step 5: Recurse into renamed directories | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Docs/Manual/Japanese/Filters.xml | 1008 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 1)</literal> は | CODE |
| LOW | Docs/Manual/Japanese/Filters.xml | 1010 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 2)</literal> は | CODE |
| LOW | Docs/Manual/English/Filters.xml | 1072 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 1)</literal> returns <lit | CODE |
| LOW | Docs/Manual/English/Filters.xml | 1073 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 2)</literal> returns <lit | CODE |
| LOW | Docs/Manual/Hebrew/Filters.xml | 1139 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 1)</literal> | CODE |
| LOW | Docs/Manual/Hebrew/Filters.xml | 1141 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 2)</literal> | CODE |
| LOW | Docs/Manual/French/Filters.xml | 1207 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 1)</literal> | CODE |
| LOW | Docs/Manual/French/Filters.xml | 1209 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 2)</literal> | CODE |
| LOW | Docs/Manual/Spanish/Filters.xml | 1217 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 1)</literal> | CODE |
| LOW | Docs/Manual/Spanish/Filters.xml | 1219 | <listitem><para><literal>regexExtract("user@example.com", "([^@]+)@([^@]+)", 2)</literal> | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Externals/poco/Foundation/include/Poco/LogStream.h | 96 | /// Usage example: | COMMENT |
| LOW | Externals/poco/Foundation/include/Poco/Process.h | 141 | /// Usage example: | COMMENT |
| LOW | Externals/poco/Foundation/include/Poco/Process.h | 176 | /// Usage example: | COMMENT |
| LOW | Externals/poco/Foundation/include/Poco/Dynamic/Var.h | 127 | /// Example usage: | COMMENT |
| LOW | Externals/poco/Foundation/include/Poco/Dynamic/Var.h | 150 | /// Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …googletest/googletest/include/gtest/gtest-death-test.h | 152 | // This implementation is *not* meant to be as highly tuned or robust | COMMENT |
| MEDIUM | …googletest/googletest/include/gtest/gtest-death-test.h | 224 | // In practice, this can be used to test functions that utilize the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Translations/GetTranslationsStatus.py | 73 | CODE | |
| LOW | Translations/GetTranslationsStatus.py | 122 | CODE | |
| LOW | Translations/GetTranslationsStatus.py | 249 | CODE | |
| LOW | Translations/GetTranslationsStatus.py | 419 | CODE | |
| LOW | Translations/GetTranslationsStatus.py | 562 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Externals/boost/boost/unordered/unordered_printers.hpp | 279 | ".ascii \"def boost_unordered_build_pretty_printer():\\n\"\n" | CODE |
| LOW | Testing/PluginTests/PluginTests.js | 567 | function IgnoreLeadingLineNumbersTest() { | CODE |
| LOW | Testing/PluginTests/PluginTests.js | 763 | function CompareMSPowerPointFilesTest() { | CODE |
| LOW | Testing/PluginTests/PluginTests.js | 776 | function CompareEscapedJavaPropertiesFilesTest() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Translations/ShellExtension/CreateMasterPotFile.js | 160 | oPotFile.WriteLine("# This file is from WinMerge <https://winmerge.org/>"); | CODE |
| MEDIUM | Translations/WinMerge/CreateMasterPotFile.js | 267 | oPotFile.Write("# This file is from WinMerge <https://winmerge.org/>\n"); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Translations/GetTranslationsStatus.py | 30 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Docs/Developers/doxygen.cfg | 365 | # Set it to YES to include the internal documentation. | COMMENT |