How do I understand code an AI wrote?

Code an AI wrote reads fluently, which is exactly why it needs a different checklist than code a colleague wrote: fluency is not understanding, and a plausible-looking diff can still be wrong, incomplete, or quietly out of scope. DiffGuardian matches most of this checklist to a specific feature, starting with splitting the change into the features it ships so you can read it, hear it or see what it touches.

#A checklist, without any tool

• Confirm it does what it claims, not just what it looks like it does. Compare the change against the stated intent — a PR description, a ticket, a prompt you gave the agent — line by line, not as a vibe check.
• Check the error paths, not just the happy path. AI-generated code reliably handles the case it was asked about and reliably under-handles the cases it was not: empty inputs, nulls, timeouts, a request that fails partway through.
• Look for a caught error that does nothing. An empty or overly broad catch block is an easy way for a change to look like it works in every test that matters and fail silently everywhere else.
• Check every caller of anything the change renamed, removed or changed the shape of. An AI editing one file has no visibility into every place that calls it; you have to supply that.
• Read the tests it added, not just their names. A test that asserts something is truthy, or that a function did not throw, is not the same as a test that would fail if the logic were wrong.
• Watch for scope creep. Check whether the diff touches only what the task asked for. An unrelated file changing alongside the intended fix is worth a question, not an assumption.
• Check anything security-sensitive by hand, always. Input validation, authorization checks, and anything touching secrets or payments deserve a careful, skeptical read regardless of how confident the rest of the diff looks.
• Do not approve on fluency. Well-formed code, sensible naming and clean formatting are not evidence of correctness. Verify the logic independently of how well it reads.

#The DiffGuardian features that match this checklist

• Confirming intent and catching scope creep. DiffGuardian reads the pull request against the whole repository it changes, then splits it into the features it actually ships and orders them by risk, so an unrelated change stitched into the same diff shows up as its own item instead of hiding inside a larger one. See Review a big PR feature by feature.
• Checking error paths and edge cases. Ask your codebase (Pro) answers a direct question about the pull request or the repository — does this handle the empty-list case?, what breaks if this runs twice? — instead of you tracing it out by hand.
• Checking every caller of a changed contract. DiffGuardian's blast-radius view maps a changed file's dependencies from the diff alone — the changed files and the modules they import — and, with a local checkout, adds the upstream callers that flow into it, drawn solid, plus dashed API and channel edges. Checking every caller needs that local checkout. See See what a pull request actually affects.
• Tracing the logic end to end. Trace It (Pro) moves across every file a feature touches, in the order the code actually runs, with the diff shown at each step — useful for a change whose correctness depends on a sequence, not any single line.
• Reviewing code you cannot send to a cloud provider. A fully local setup — Ollama, LM Studio, llama.cpp or vLLM — keeps the review on your machine; see AI code review that works offline. With your own key instead, code goes directly from your machine to the provider you chose, never through DiffGuardian's servers; see AI code review with your own API key.

DiffGuardian is a desktop app for macOS, Windows and Linux, and works with pull requests on GitHub, GitLab and Bitbucket.

#Limits

• DiffGuardian's findings are a well-informed first pass, not a verdict — follow the citation before acting on any of them, the same way you would check a human reviewer's claim.
• Ask your codebase and Trace It are Pro features. On Basic, the feature split runs on a local model (Ollama, LM Studio, llama.cpp or vLLM); using your own cloud-provider key needs Pro. The blast-radius view needs no AI and works on every plan.
• DiffGuardian does not approve, merge or submit anything on its own; every posting action is one the reviewer takes.