How Blamer works

Three surfaces. One Attribution Engine. Every scan answers three questions: What is wrong? How severe? Who wrote it — human or which AI tool?

The pipeline

SCAN -> DETECT -> ATTRIBUTE -> REPORT

  URL / PR / local code
    -> Headless browser captures DOM + network + console
      -> Detection engines find issues across 8 categories
        -> Attribution engine classifies: human or AI tool X
          -> Report with per-issue blame data + per-tool quality profile

Three delivery surfaces

1. URL Scanner

Paste any public URL. Blamer launches a headless Chromium, captures the DOM + network + console, runs eight detection engines, then attributes each finding via fingerprinting (no repo access required).

Total scan time: ~11 seconds
Confidence range without repo access: 0.50–0.85
Zero friction: no GitHub OAuth, no install
Use case: Compliance audits, vendor assessments, CISO production sweeps

Try a live URL scan

2. GitHub App

2-click install on any GitHub organization. On every PR Blamer scans changed files, runs git blame + Co-Authored-By header analysis, and posts an attribution table as a PR comment. Branch protection optional.

Confidence range with repo access: 0.80–0.99
Free for public repos (unlimited)
SARIF export for GitHub Code Scanning
Use case: PR-level review prioritization, CI/CD quality gates

3. CLI Tool

Run locally before commit, or in any CI/CD pipeline:

npx @blamer/cli scan ./src
npx @blamer/cli scan https://example.com

Pre-commit hook or pipeline step
Configurable severity thresholds per AI source
SARIF, JSON, and human-readable terminal output
Use case: DevSecOps quality gates with attribution-aware thresholds

Eight detection categories

Category	Detects	Engine	Severity
Data leaks	API keys, PII exposure, secrets in DOM	TruffleHog patterns + custom	Critical
Performance	LCP/CLS/INP regressions, memory leaks, N+1	Lighthouse + custom	High
Security	XSS, SQLi, SSRF, insecure endpoints	Custom rules + OWASP patterns	Critical
Accessibility	WCAG 2.1 AA violations	axe-core	High
AI compliance	EU AI Act Art. 50 transparency, AI-content marking	EU AI Act rules + custom	High
Regulatory / ISO	ISO 27001, MDR, PCI DSS, HIPAA, SOC 2 gaps	Framework mappings	Medium
SEO	Schema.org, heading hierarchy, meta tags	Custom rules	Medium
Sustainability	WSG violations, carbon footprint, green hosting	WSG rules + custom	Medium

Attribution engine (Patent G)

Mode	Available when	Method	Confidence
Git-blame-based	Repo access (GitHub App, CLI)	Commit metadata, Co-Authored-By, IDE markers, author patterns	0.80–0.99
Fingerprint-based	URL scan (no repo)	AI naming patterns, code structure, comment style, framework usage	0.50–0.85

Supported AI tool profiles: Copilot, Cursor, Claude Code, Windsurf, Devin, CodeWhisperer, Tabnine. Extensible via profile plugins.

Validation evidence

Patent G's multi-signal AI code attribution methodology was cross-referenced against 6,439,303 code samples spanning 64 distinct AI models (Llama, Qwen, DeepSeek, Gemini, Phi, GPT-4, Claude, IBM Granite, etc.) across 13 programming languages and 9 published datasets (PoC v3.0, March 2026). End-to-end Blamer classifier accuracy on production customer code is pending Patent G PoC v4.0 (industrial-scale, 100M+ samples).

Three confirmed claims

Multi-signal detection necessary. Single-feature classifiers (e.g. code length alone) are insufficient — Cliff's δ 0.07–0.28 (negligible-to-small effect size across 6M+ samples). Patent G's multi-signal architecture is necessary, not optional.
Per-model fingerprinting feasible. Distinct line/character/stdev signatures per LLM (e.g. o3-mini avg 169.9 lines vs. llama3.3 avg 83.2 — a 2× difference). Enables per-tool quality scoring on customer codebases.
AI adoption exponential. DevGPT corpus shows 145% growth in 77 days (Spearman r_s = 0.98, p < 0.001); power users dominate (Gini 0.68 — top 7% of authors produce 41% of AI commits).

Source: PATENT_G_POC_V3_REPORT.md. All 7/7 Patent G claims CONFIRMED with STRONG-to-VERY-STRONG evidence at scale.

See pricing →