Welcome to the Vericto documentation

Everything you need to integrate Vericto, configure rules, use the REST API and understand the deterministic AST proxy.

1 Pull the image

Pull the Vericto proxy image:

$ docker pull ghcr.io/vericto/vericto-proxy:latest

Next: deploy →

Getting started

Start here All of Vericto, from zero to production The complete introduction: how the deterministic AST proxy works, how to connect it, and how to protect your databases in minutes. Read the introduction Integration Connect in under 10 minutes No code changes. TCP proxy or HTTP API, with examples for Docker, Kubernetes, ECS and your CI/CD pipeline. View the guide

Why Vericto

AST · Deterministic parsing

What is AST and why is it the best option?

Vericto parses every query into its Abstract Syntax Tree (AST), the same structural representation your database uses, via libpg_query, instead of guessing with regular expressions or heuristics. It analyzes the structure of the statement, not its text: that's why it catches what allowlists and regex miss.

  • No false positives by design. Deterministic: the same query always yields the same verdict. No probabilistic models, no variance.
  • Sees what others miss. Multi-statement, data-modifying CTEs (WITH … DELETE), subqueries and tautology injection (OR 1=1), all over the full AST, multi-dialect.
  • Unbeatable performance. Evaluation runs in-process in the TCP proxy, with no network calls on the hot path. P99 < 2 ms.

Interception in the PostgreSQL wire protocol

'P' Parse: prepared statements evaluated at the Parse phase, before values are bound. Protection independent of runtime parameters. 'Q' Simple Query: the full statement is evaluated inline before it runs. The destructive query never reaches the database.
See the full architecture

Ways to connect

Recommended TCP proxy deployment The recommended path: the proxy intercepts the PostgreSQL wire protocol. Transparent protection, no code changes. Deploy it however you like. Docker Compose Kubernetes CDK / ECS HTTP API for CI/CD Evaluate queries and migrations via REST before deploying, without installing the proxy. Ideal for validating changes in your pipeline. GitHub GitLab CircleCI Jenkins Languages & ORMs Any driver that speaks the PostgreSQL protocol works unchanged. Examples for the most-used ORMs and languages. Prisma SQLAlchemy TypeORM Drizzle Hibernate

Reference

AST rules Complete catalog of VERICTO-* rules: what they detect, severity, action and supported dialects. VERICTO-* Severidad Query examples Real cases side by side: what gets blocked and why, what passes, and the most common edge cases. DELETE DROP Edge cases Custom rules Extend the ruleset with YAML conditions over the AST: schema, node types, conditions, API and preview. YAML API REST

Security & community

Security & compliance Zero-trust architecture, encryption and storage, authentication, SOC2/ISO 27001 compliance and vulnerability reporting. Zero-trust SOC2 ISO 27001 Discord community Join the Vericto community: ask questions, share custom rules and get support from other developers and the team. Join Discord Need help? Can't find what you're looking for or have a use case the docs don't cover? Reach us through the right channel. View contacts