Public prices are useful for study and unsuitable for execution
OpenTerminal's README says its prices may be delayed, incomplete, or wrong and warns against using the application for real investment decisions. Read that before the terminal-style screenshot. A chart beside a watchlist and news feed can help you explore a company or understand a market move. The interface cannot turn public endpoints into a licensed feed with a guarantee about freshness. That distinction determines whether this dashboard fits your job.
Our sandbox found a manageable codebase: 89 files, roughly 6,072 source lines, and a 3.9 MB checkout. It is appealing material for a developer who wants to inspect how market widgets connect to providers. Someone expecting a dependable trading workstation has a different requirement. The project itself draws that boundary in its data-source warning, even when other README language makes the experience sound more certain.
What happened when we ran it
Our run installed 618 npm packages in 38 seconds, built successfully in 53 seconds, and passed all 26 Vitest tests in 4 seconds. Installation used 549 MB on disk. We ran commit aed097c on October 15, 2026, in a fresh Debian sandbox with 3 CPUs, 8 GB of RAM, and the lab-node:22 image. The container was unprivileged and had no secrets.
npm audit reported 14 known vulnerabilities: 5 critical, 4 high, 5 moderate, and 0 low. Those are the findings from our measured checkout, regardless of the README's narrower discussion of dependency advisories. The supplied record does not identify vulnerable packages or establish whether affected code is reachable in a running service. It is enough to require dependency investigation before adoption, and insufficient to declare a particular exploit.
Our scan found 1 CI workflow file, workspace packages, and a Compose file, without a tests directory or standard root Dockerfile. Tests can live beside source files, so the directory result does not contradict the passing suite. These checks establish repository installation and command outcomes. They do not establish market-data accuracy, a successful Compose deployment, or the quality of the optional assistant's answers.
Some data families have fallbacks, while others have one provider
The README's provider table sends stock quotes through Nasdaq, with Yahoo Finance and Stooq as fallbacks. Other rows, including fundamentals and the market screener, show a single provider. Its broad promise that every endpoint has a fallback therefore needs qualification. If the particular panel you depend on has only one listed source, the application's overall provider count does not give that panel an alternate route.
The 26 passing tests did not measure feed freshness. The cache implementation keeps previous values and can return them when a fresh fetch fails. That helps preserve a readable screen during an outage, but a visible number can be old. A useful adoption check is whether your chosen symbols and widgets return data you can independently understand, including what happens when their provider stops responding.
The workspace combines local records with remote data
The documented interface has resizable panels, a symbol command palette, and charts with technical indicators. You can place a news feed near the active symbol or keep a portfolio log alongside the watchlist. Layout persists locally, while portfolio transactions live in SQLite. This arrangement suits personal exploration because you can shape the screen around the questions you keep asking, without signing up for a hosted dashboard.
The 549 MB installed environment is the local footprint we measured, not a substitute for those outside services. Quotes and news still come from network requests. The optional Claude widget adds a provider credential and external inference to the picture, even though the market-data path requires no paid API key. Leave that widget disabled if the reason for trying OpenTerminal is a dashboard without an AI account.
Local defaults do not establish safe public hosting
The Compose file publishes both services on loopback, and the README describes an automatically generated secret for protected API routes. Those are sensible local defaults. The bundled web proxy reads that secret and attaches it to forwarded requests. Consequently, backend secret protection alone does not establish that every person reaching the web interface has been authenticated.
Our 14 audit findings are separate from the proxy concern. Open PR #43 specifically reports that reachable web clients can obtain portfolio and paid-AI access through the bundled proxy, and proposes additional access checks. We have not reproduced that report, and the proposal remains open. Keep this application local rather than assuming the README's wider-hosting settings amount to a reviewed shared-service design.
October maintenance continues beyond the September release
The last push was October 6, 2026, and GitHub listed 15 open issues and PRs. Release v0.2.0, published September 8, added economic and earnings calendars. October discussion and proposed fixes show activity beyond that release tag. Features in open pull requests are still proposals: price alerts and options Greeks remain unchecked README roadmap items, so choose based on what the main branch documents today.
OpenBB's Open Data Platform is a better candidate when you want programmable data integration for research. Ghostfolio deserves a look when maintaining portfolio records is the central task. For OpenTerminal, our successful 53-second build makes local experimentation reasonable. Before saving anything you care about in its portfolio, back up the SQLite data and confirm how you will recover it. Keep an independent source beside any price you intend to act on.