1.14
27 August 2026
Changed
An unusual entry: this release removes functionality. Six controls that looked like they worked have been switched off, because they did not, and a control that lies to you is worse than one that is plainly unavailable.
- Turning an alert rule off moved the switch and changed nothing on the server. Reloading brought the rule back, still firing — and you would have walked away believing it was disabled
- Acknowledge, Snooze, Edit, Duplicate and New rule had no handler at all. They clicked and nothing happened, silently, which is the same untruth told more quietly
- All six are now visibly disabled and say why when pressed: Diffport has no sign-in yet, so nothing on this screen can be changed. What you see is exactly what the server holds
- They become real when accounts arrive. Until then the screen reports the server's state and nothing else
- Disabled has to look disabled, too — the first attempt dimmed them so far they read as missing, which is a different wrong answer
1.13
27 August 2026
Added
Rules watch every pull request as it arrives — destructive schema changes, high risk, a secret in a diff, a migration with no tests, coverage falling below a threshold, untraced commits merging. Each firing arrives with the reasoning attached, not just a verdict.
- Every firing records which field matched, which comparison, and the actual value. An alert you cannot interrogate is an alert people learn to filter
- One alert per pull request, not one per event. Four destructive operations produce one message. Four would be technically accurate and would teach you to mute the channel
- Re-processing does not re-fire. Every push to an open pull request re-runs the whole pipeline; an alert already open for that rule is left alone, so a branch under active work does not alert on every commit
- A rule referring to a field or operator the engine does not know never fires. Silence is the safe failure for a misconfigured rule — firing on everything is not
- Rules evaluate after risk scoring, never against a half-scored pull request
- Six defaults are created on the first pull request Diffport sees, and only if you have none. Edit or delete any of them
1.12
27 August 2026
Added
Diffport has never connected to your database and never will. It has no credentials, runs no queries, and holds no copy of your data. The schema you see is reconstructed entirely from the migration files in your pull requests.
- Every DDL statement is replayed in order —
CREATE TABLE defines columns, ALTER adds, drops and retypes them — building a model of what your schema is now - Each column is attributed to the commit that introduced it, so a table shows you how much of itself was machine-written and which agent wrote which field
- Replay follows migration filename order, not commit order. Files are numbered because the order they must run in is not the order they were written — backfilling an early-numbered migration is ordinary, and getting this wrong resurrects tables that were dropped
- Dropped tables and columns are kept and flagged rather than deleted. A schema that forgets what was removed cannot answer who removed it, or when
- Foreign keys are drawn only when both ends still exist, and tables are laid out by dependency depth — a table sits to the right of everything it references
- No domain groupings are invented. Diffport cannot know that a table belongs to your billing layer, so it does not pretend to
1.11
26 August 2026
Added
Diffport now reads your repositories. Install the GitHub App and every pull request that opens is resolved on its own — authorship, coverage, schema impact and risk — with no step you have to remember.
- A GitHub App with three read-only permissions and nothing else. Diffport cannot change your code, and the install screen shows you the permissions before you agree
- Pull requests are picked up as they open, and again as they change
- Every webhook is signature-verified before it is accepted; anything unsigned or mis-signed is refused and logged
- Repositories are selected individually — granting access to everything is a choice, not the default
1.10
26 August 2026
Added
The review queue is an ordering now, not a list. Every pull request carries a score from four weighted factors — data loss, security, performance, test coverage — and the highest-risk work sits at the top.
- Migration files are parsed statement by statement, so
ADD COLUMN x, DROP COLUMN y is graded as two changes at two severities rather than one blurred verdict - A destructive change with no down-migration is floored at 70. It can never read as low risk, whatever the other factors say
- A live credential found in a diff carries the same floor. A weighted sum can say how much risk; it cannot say this one thing is disqualifying, so that case is handled separately
- AI authorship is deliberately not a risk factor. It raises the review requirement, not the score — a tool that flags all machine-written code as dangerous teaches people to ignore it
1.9
26 August 2026
Added
The part that produces the answer rather than displaying one. It reads git — commit trailers, app actors, co-author lines, branch patterns, diff shape — and resolves each commit with the evidence attached.
- Every signal carries its own confidence, and the figure reported to you is the weakest link in the chain rather than the strongest
- Low-confidence signals annotate but never score. Diff shape can tell you a commit looks machine-written; it is never allowed to decide that it is
- Human is a positive attribution, not a leftover. A commit is attributed to a person on a verified signature, not on the absence of an agent signal — because absence of evidence is exactly what untraced means
- A signature never overrides an agent trailer: a person can sign a commit an agent wrote
- Ask any commit why, and it shows the evidence chain — which signals scored, which only annotated
1.8
26 August 2026
Added
A product that tells you where your code came from should be able to tell you where it came from itself. Every release from here is written down on the day it ships, in plain language, with what broke as well as what landed.
- Deep-linkable anchors on every entry, so a single change can be sent to someone directly
- Built on the same tokens as the app — one colour system, one type scale, one set of corners
- Fixes and regressions are listed alongside features rather than quietly omitted
1.7
26 August 2026
Added
A schema diagram is a commodity. One that tells you which agent added which column is not. Schema shows every table in a repository, how much of it was machine-written, and what an open pull request is about to do to it.
- Entity map grouped by domain, with foreign keys drawn between tables
- Authorship split on every table —
session_locks is 100% machine-written, memberships entirely human - Per-column origin in the inspector, naming the agent and the pull request behind each alteration
- A marker on any table with a pending change from an open pull request
1.6
22 August 2026
Added
Getting started should take a minute, and it should be obvious what you are agreeing to. The new flow states the permissions in plain language — including the one that matters most.
- Read-only by design: Diffport cannot change your code, and the install screen says so
- Pick repositories individually rather than granting access to everything
- The first scan shows its working — reading history, resolving signals, parsing DDL, scoring risk
1.5
18 August 2026
Added
The product should not require you to remember to open it. Alert rules watch for the things that actually matter and deliver to Slack, email or a webhook.
- Rules for destructive DDL from an agent, high-risk merges without human review, falling trust scores and untraced commits on main
- Severity as a coloured edge on the row, not a wall of red
- Acknowledgement is a state on the alert, not a per-person read flag — a team surface, not an inbox
1.4
14 August 2026
Added
For an auditor, a client hand-off, or a security questionnaire. Choose a scope, choose what goes in, and get a report signed against the commits it covers.
- Scope a report to a repository, a date range, or a single pull request
- PDF, JSON or CSV
- An expired share link never invalidates the attestation — the report stays verifiable, only the link lapses
1.3
8 August 2026
Added
Nine agents across eight vendors, ranked. Not on volume — on risk rate, reverts, test-coverage delta and review load.
- Claude Code, Cursor, GitHub Copilot, OpenAI Codex, Qwen Code, DeepSeek, Lovable and Replit
- Schema exposure reported separately, never folded into the score: knowing an agent is 3.1× more likely to ship risk when it touches the database is a routing decision
- Volume is deliberately not a factor. Two hundred pull requests does not make an agent trustworthy
1.2
1 August 2026
Added
Open any pull request and see who wrote each run of lines — which agent, which model, which session, and the evidence behind the verdict.
- Attribution blocks rather than per-file colouring, because a file is rarely written by one author end to end
- Every signal carries its own confidence, and the reported figure is the weakest link in the chain
- Untraced is its own state, never quietly reported as human
1.1
24 July 2026
Added
Improved
A year of machine-written commits at a glance, plus the numbers that tell you whether review is keeping up.
- Daily contribution heatmap across every connected repository
- Schema changes reaching main, split safe against destructive
- Time to merge by author type — the measurement that shows review, not generation, is the bottleneck
1.0
15 July 2026
Added
The review queue, ordered by risk rather than by date. Every pull request tagged with its true authorship and scored across data loss, security, performance and test coverage.
- Risk score with all four factors shown, never a single opaque number
- Schema impact on every pull request that touches the database layer
- AI authorship raises the review requirement, not the risk score — a tool that flags all machine-written code as dangerous teaches people to ignore it
