Your Standard

# One Standard for every agent.

Your team's rules live in one versioned file, committed to the repository. Every review, on every machine and in every session, is measured against it by a reviewer the agent cannot argue with.

.verity/standard.yaml

```
extends:
  - verity/core          # every project
  - verity/api           # chosen from your stack by verity init
overrides:
  type_safety: off       # turn off any rule or lens
custom_patterns:
  - id: validate-at-boundaries
    severity: high
    rationale: >
      Applies to user input, external APIs and webhook payloads only.
      Internal service-to-service calls are out of scope.
```

## Start from the public rules

A Standard extends review packs from the rule catalog. `verity/core` applies to every project, and `verity init` picks the others from your stack: API, Data, CLI, Payments, Web. Each rule names the evidence a finding must show.

Turn any rule off, or change its severity, in `overrides`. The packs bring their rules, so the file holds only what your team changed.

[See the rule catalog](https://verity.md/catalog)

- **Comprehensibility** Code you can read in one context load. Defaults: files up to 300 lines, functions up to 50, complexity up to 15.
- **Modularity** One concern changes without touching three or more files.
- **Type safety** The type system catches errors before runtime. Add your language's own, such as strict mode.
- **Test adequacy** Tests define what the code should do: 80% coverage by default, 90% for AI-written code.

## Security rules mapped to CWEs

*Security rules in verity/core, their severity and the CWEs they map to*

| Rule in verity/core | Severity | Maps to |
| --- | --- | --- |
| Injection into an interpreter | Critical | CWE-89, 78, 94, 502, 611 |
| No hardcoded secrets | Critical | CWE-798 |
| Object-level authorization | High | CWE-639, 862 |
| Checks fail closed | High | CWE-636, 755 |
| Secrets and personal data in logs | High | CWE-532, 359 |

Plus seven more in core, and the API, CLI and Web packs add rules for their kind of project.

## Your project's own rules

The conventions a reviewer would otherwise learn by hand, such as “all API routes go through the auth middleware”. Verity can write them from your repository profile, and you add your own.

A rule's rationale reaches the reviewer word for word, so a rule that says where it applies is applied only there.

[Read the docs](https://verity.md/docs/standard)

## Agents write the code. Verity keeps it true.

Start on the Free plan. Working with Claude Code today.

[See the benchmark](https://verity.md/benchmark) [Questions? Chat with us on Slack](https://start-chat.com/slack/codacy/C1rsa5)

$`npm install -g @codacy/verity-cli && verity init`

Works with

OpenAI Codex Soon CI/CD Soon GitHub Agentic Workflows Soon AI Gateway Soon

Source: https://verity.md/product/standard