diffold is currently pre-1.0. Please use the latest published version.

Please report vulnerabilities privately via GitHub Security Advisories — do not open a public issue for security reports. Include enough detail to reproduce the issue.

Non-sensitive bugs can be filed as regular GitHub issues.

• Read-only by default: comparison never writes or deletes. The only exception is the explicit -f / --file / --output report-file option, which creates or overwrites a single report file the caller named (overwrite requires --force).
• No network access.
• No runtime dependencies in the compiled CLI.
• Uses Node-compatible built-in modules only.
• Explicitly skips symbolic links during traversal.
• Streams directory entries during traversal and fails closed when traversal limits are exceeded.
• Reports unreadable subdirectories and marks incomplete comparisons instead of silently exiting successfully.
• Content comparison streams files through SHA-256 in fixed-size chunks; it never buffers a whole file or retains contents. Pass -c / --no-content for a presence-only run that never opens file contents.
• JSON mode keeps stdout to a single JSON document; all diagnostics, [skip] lines, and warnings stay on stderr so piped output is safe to parse.
• --exclude prunes excluded directories before descending and cannot widen traversal beyond the resolved-root containment guard.
• Report files are written only where the caller asked: parent directories are created, an existing file is never overwritten without --force, and every printed path is sanitized.