Try Tidemark
The same engine as the command line, compiled to WebAssembly. Files stay in your browser; ledger checks go straight to the RPC you choose.
What changed in this upgrade?
Drop the deployed program and the new build. Tidemark reads the sBPF bytecode, diffs it and flags risky changes. Everything runs in your browser; no file leaves this page.
Attestation ledger
Reviews are written to a hash-linked ledger on Solana and co-signed by a quorum of reviewers. This page fetches the raw accounts over RPC and checks every link, address and signature count itself.
Who can upgrade?
Every upgradeable Solana program has an authority that can replace its code. This page reads each program over RPC and says whether that authority is a single key, a multisig, a governance or nobody at all.