For immediate release
Most tools that claim to detect AI-written code return a confident percentage. Diffport, which opens to every team today, returns untraced when the evidence is not there — and never resolves that into a claim that a person wrote it.
Toronto, 4 September 2026
Engineering teams now merge code that nobody on the team typed. The tools that wrote it leave uneven traces: some stamp a commit trailer, some author through a registered app identity, some leave nothing at all. Ask most detection tools what happened and they will give you a number anyway.
Diffport is built on the opposite premise. It reads the repositories a team
connects, gathers whatever evidence actually exists — commit trailers, app actors,
co-author lines, branch conventions, diff shape — and reports a verdict per run of
lines. Where no signal is found, the verdict is untraced. Not
probably human. Not a confidence score massaged toward a guess.
The distinction matters commercially. A team answering an auditor, a customer security questionnaire, or an internal policy on machine-written code needs to know the difference between a person wrote this and we have no idea who wrote this. A tool that collapses the two is worse than no tool, because it manufactures confidence that the evidence does not support.
“Every competitor I looked at answers the question you asked, even when the data cannot answer it. That is the entire product decision. If we cannot prove who wrote a line, we say so, and we let that be uncomfortable. An auditor can work with unknown. Nobody can work with a number that was invented to avoid saying it.”
Ezra, founder and CEO, Diffport
Diffport connects to GitHub with read-only permissions and no write scope of any kind — it cannot push, merge, open pull requests or change branch settings. That is a fact about the permissions granted, not a policy the company promises to honour.
For every pull request it reports which agent wrote what, at what confidence, with the evidence attached. It recognises ten coding agents today, including Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Devin, Aider and Replit Agent. It scores risk across data loss, security, performance and test coverage, and reconstructs a view of the team’s database schema from migration history so that a destructive change is visible before it reaches production.
AI authorship raises the review a change needs, not its risk score. A tool that flags all machine-written code as dangerous teaches people to ignore it.
Diffport issues provenance reports as PDF, JSON or CSV. Each is generated once, stored byte for byte, and served back unchanged, with a SHA-256 recorded against it. A report downloaded today still verifies against its hash next year, whether or not the account that produced it still exists.
A read-only HTTP API exposes the same data across nine endpoints, with bearer tokens scoped to a single workspace at 600 requests an hour.
Diffport publishes what it has not built, on its pricing and security pages, in the same type size as what it has:
The company also publishes its own faults. Its changelog records, by version and date, the releases where a control reported a state it did not have — including a two-factor switch that showed itself turned on before any second factor existed.
Pricing is per workspace rather than per seat, which means adding a reviewer costs nothing. Cancellation is a button inside the product, with no notice period and no call to book.
Diffport reads the repositories a team connects and reports the provenance of the code inside them: which parts a machine wrote, which a person wrote, and which carry no signal at all. Code with no signal is recorded as untraced and is never inferred to be human. Confidence is reported as the weakest signal behind a conclusion, not the strongest. Diffport is independent, unfunded, and available at diffport.com.
Ezra, founder and CEO
ceo@diffport.com
@diffport on X
Logos, wordmarks, product screenshots and usage rules: diffport.com/press
— ends —
