Methods, systems, and apparatus, including computer programs encoded on computer storage media, for matching and attributing code violations. One of the methods includes receiving a plurality of snapshots of a code base, including data representing a revision graph of the snapshots of the code base and data representing respective violations in each of the plurality of snapshots. A plurality of transitively matched violations in the code base are generated, wherein each transitively matched violation represents a respective sequence of matching violations from a first violation of a first snapshot to a second violation of a second snapshot, wherein each transitively matched violation identifies a respective first violation representing an initial occurrence of a coding defect in the code base and a respective second violation representing a last occurrence of the coding defect in the code base.