01 — GET THE LAY OF THE LAND
Bring your code.
Paste a program, upload a Rust file, or explore a public GitHub repository. Your first review starts right in your browser.
A SOLANA-NATIVE CODE REVIEWER
Let good
code bloom.
Deep in your codebase. Native to your ecosystem.
Catch the bugs hiding between the lines,
before they ever touch the chain.
✳ Less second-guessing. More shipping. // gm, better code
FIG. 001NARCISSUS · DIFFODILE
+
ROOTED IN CONTEXTBuilt to see the bigger picture.
01 / ALWAYS GROWING◎ SOLANA ECOSYSTEM
Made for the ecosystem.
Right at home in your stack.
solanaAnchorRustGitHub
01 A FRESH PAIR OF EYES
Small diff.
Big difference.
A missing signer. An unchecked account. A tiny change with a not-so-tiny consequence. See what a Solana-aware review can surface.
diffodile / review INTERACTIVE EXAMPLE
programs/vault/src/withdraw.rs+8 −2
Anyone can sign this withdrawal. Literally anyone.
SUGGESTED FIX
More context. Fewer blind spots.RUST + ANCHOR ↗
A LITTLE CONTEXT GOES A LONG WAY.No wallet access. No transaction signatures. Just your code.
02 DEEP ROOTS. BETTER REVIEWS.
Not just the diff.
The whole ecosystem.
Your Solana program doesn’t live in isolation.
Neither should your code review.
02 — FIND THE HIDDEN THINGS
Look beneath the surface.
Run Solana-specific checks for common risky patterns. Connect your own AI provider for deeper, contextual analysis.
03 — KEEP THE GOOD THINGS GROWING
Understand. Fix. Ship.
Get line-level explanations and practical fixes. Export your findings, make the change, and review again.
THE DIFFODILE PHILOSOPHY✳LESS NOISE. MORE SIGNAL.
✳On-chain is forever.
On-chain is forever.
“Probably fine” isn’t enough.
Good tooling doesn’t replace good engineers.
It gives them the room to do their best work.
BUILT WITH INTENTION.FOR THE PEOPLE BUILDING WHAT’S NEXT. ↗
03 NATIVE, NOT AN AFTERTHOUGHT
Speaks Rust.
Thinks Solana.
The right questions. The right context.
Made for a different kind of runtime.
SECURITY STARTS AT THE ACCOUNT
Trust is good.
Constraints are better.
Spot missing signer checks, unchecked accounts, and unsafe arithmetic before a small oversight becomes an expensive lesson.
pub authority: Signer<'info>✓#[account(has_one = authority)]✓amount.checked_add(deposit)?✓ THE LITTLE DETAILS ARE THE BIG DETAILS.
YOUR CODE. YOUR CONTEXT.
A reviewer that
gets your program.
Add project context and review priorities. Pass them into your connected AI review, not into another forgotten document.
review-context.md
# Review priorities
Check PDA seed validation.
Prefer checked arithmetic.
Explain the exploit path.
KEEP YOUR KEYS. KEEP YOUR CODE.
Local by default.
Browser checks stay in your browser. No wallet connection, no hidden uploads. AI analysis only runs when you explicitly request it.
GOOD THINGS TAKE ROOT.04 MADE FOR BUILDERS
A little less friction.
A lot more flow.
From the first Anchor program to the protocol you can’t stop thinking about. Spend less time chasing the obvious and more time building something that matters.
No installation to try the playground
Your files, your browser, your control
Clear findings you can actually act on
05 ROOM TO GROW
Start small.
Build something big.
A useful first step, without a sales call.
No invented limits. No surprise subscription.
THE PLAYGROUNDREADY NOW
Free / always
A fresh pair of eyes on your next program.
- Browser-based Solana checks
- Rust file upload & public GitHub browsing
- Custom review context
- Markdown & JSON exports
- Workspace saved on your device
YOUR OWN DEPLOYMENT
Your AI. Your rules.
Bring a provider. Keep control of the infrastructure.
- Everything in the playground
- Optional server-side AI review
- Your own OpenAI-compatible provider
- Protected API access & rate limiting
- Flat-file, Hostinger-compatible deployment
06 GOOD QUESTIONS
A little
more context.
What does Diffodile actually review?
The playground checks Rust and Anchor source for common risk patterns: missing signer constraints, unchecked accounts, panic-prone calls, unsafe blocks, and unchecked arithmetic. These are heuristic checks, not a full security audit. An optional AI connection can analyze the submitted source with your project context.
Is this the same as a security audit?
No. Diffodile is a development aid. Findings may include false positives, and a clean result does not mean a program is secure. Use tests, independent audits, and a thorough manual review before deploying contracts that hold value.
Does my code leave my browser?
Not for local checks. Your workspace stays in this browser’s local storage. Browsing a public GitHub repository contacts GitHub. If you explicitly select AI analysis, your source and project context are sent to this site’s backend and its configured AI provider.
Can I connect a private GitHub repository?
This version supports public repositories without authentication. For private code, upload or paste a file locally. Automated pull-request reviews and private GitHub App access require an additional GitHub integration; they are not enabled in this deployment.
Do I need a wallet or SOL to get started?
No. Diffodile never asks for your wallet, recovery phrase, or a transaction signature. You can start with the sample program, your own source file, or a public repository.
How do I enable AI reviews on my deployment?
Set your provider credentials and review access key on the PHP server, then select “Connected AI” in the playground. The deployment guide includes the exact settings. Credentials never belong in the browser or a public JavaScript file.
YOUR NEXT GOOD IDEA STARTS HERE
Better code.
From the ground up.
No credit card. No wallet. Just a little curiosity.
FIG. 002 / A NEW BEGINNING