Submit
Upload a source ZIP or use a supported public GitHub repository. Archive paths and extraction limits are checked before analysis.
SOURCE CODE PROVENANCE • MULTI-LANGUAGE • PRIVACY-FIRST
How CodeSeal source provenance works
CodeSeal creates signed historical evidence about source code without turning your source repository into permanent cloud storage. It fingerprints supported source files, compares those fingerprints with prior CodeSeal observations, and records a signed provenance event.
FROM SOURCE TO SIGNED EVIDENCE
Your code is processed. Your source is not the registry.
When you submit a ZIP archive or supported public repository, CodeSeal creates a temporary working copy, identifies supported source material, calculates cryptographic fingerprints, performs the requested comparison, and then retains the signed evidence needed for future provenance checks—not the submitted source tree itself.
Identify
CodeSeal separates supported source/configuration files from obvious caches, virtual environments, package stores, generated output, and build artifacts.
Fingerprint
SHA-256 file fingerprints, a package fingerprint, structural evidence, and PTCS provenance markers are calculated without executing submitted code.
Compare
Candidate fingerprints are compared with signed historical registry evidence to find exact files, relocated files, modified-known files, missing files, new files, and material overlap.
Sign & record
A registered observation receives stable PTCS identifiers and an Ed25519-signed event. Earlier observations remain intact; history is append-only in meaning.
Trace later activity
Future submissions can be checked against retained fingerprints. Matching evidence can create trace activity and notifications without needing the original source archive to remain stored.
LANG
LANGUAGE-AGNOSTIC REGISTRY
One provenance model across modern software stacks
CodeSeal is not a Python-only code scanner. Its core registry records source-tree evidence independently of programming language, while Phase 11 language-aware analysis identifies meaningful source blocks, reduces the weight of common constructions and obvious dependency/vendor material, and records attribution context without storing source text.
Python
Python source, project metadata and virtual-environment exclusion.
Ruby
Ruby source with Gem/Bundler-aware dependency context.
C
C source and headers with build-tree awareness.
C++
C++ source, headers and common native build metadata.
JavaScript
JavaScript modules and web application source.
TypeScript
TypeScript and TSX/modern module source.
SAP UI5 / OpenUI5
JavaScript/TypeScript, XML Views, fragments, manifests and UI5 project metadata.
HTML5
Web markup and application templates.
CSS / SCSS
Stylesheets and supported preprocessors.
Java
Java source with Maven/Gradle build context.
Kotlin
Kotlin source and Gradle-oriented project structure.
.NET / C#
C#, F# and VB source with generated bin/obj separation planned.
Go
Go source and module metadata.
Rust
Rust source and Cargo metadata with target output excluded.
ABAP / CDS
ABAP source and Core Data Services definitions.
PHP
PHP application source and package metadata.
Swift / Objective-C
Apple-platform source formats and project code.
Scala
Scala source and JVM build context.
PowerShell / Shell
Automation scripts and shell source.
Vue
Vue single-file component source.
Svelte
Svelte component source with generated build caches excluded.
GraphQL
GraphQL schema and query source.
Technology marks & privacy
The visual badges on this page are locally hosted CodeSeal technology identifiers rather than remote third-party tracking assets. Language, framework and product names remain the property/trademarks of their respective owners; their appearance here describes source formats CodeSeal can recognize and does not imply sponsorship or affiliation.
CodeSeal tries to measure authored source—not accidental baggage.
Common dependency and cache locations such as venv, .venv, site-packages, __pycache__, node_modules, package-manager caches, Rust target, framework build caches, dist, and other generated output are excluded from authored-source scanning where they can be identified safely.
Phase 11 already separates obvious dependency/vendor paths and low-uniqueness constructions from independently weighted authored-source blocks. Lockfiles, manifests, license headers and package metadata remain additional context for progressively stronger ecosystem classification rather than a reason to blindly ignore every folder named vendor.
A match does not automatically mean unattributed copying.
CodeSeal's Phase 11 provenance intelligence distinguishes raw technical similarity from attribution context. Proper source citations, public examples, license references, common helper functions, dependency/vendor material, and references to another PTCS event are classified separately from unexplained unique similarity.
Forensic reports now show both raw technical overlap and attribution-adjusted authored-source overlap. Verified PTCS references, declared citations, common constructions and dependency/vendor material remain visible as evidence but do not receive the same independent provenance weight as unexplained unique similarity.
WHY SOURCE PROVENANCE MATTERS
Source code history for developers, teams, contractors and organizations
Traditional repository history is valuable, but source can move between repositories, archives, contractors, internal systems and deployment packages. CodeSeal adds a separate cryptographically signed observation layer that can help document when a source fingerprint was submitted and how later material relates to earlier recorded evidence.
That makes CodeSeal useful for software provenance checks, source code attribution review, historical code comparison, developer handoff evidence, contractor source history, internal software governance and forensic source matching—without claiming to replace copyright registration, contracts, repository history, software licenses or legal analysis.
READY TO CHECK A SOURCE TREE?
Scan & search source →
Scan first. Register only when you choose.
A no-history scan is free. Signing/registering source is free. CodeSeal only charges for detailed history inspection when history exists and the user chooses to inspect it.