Getting started
Why Vericto
AST · Deterministic parsing
See the full architecture
What is AST and why is it the best option?
Vericto parses every query into its Abstract Syntax Tree (AST), with libpg_query (PostgreSQL's own parser) on PostgreSQL and sqlparser-rs on the other dialects, instead of guessing with regular expressions or heuristics. It analyzes the structure of the statement, not its text: that's why it catches what allowlists and regex miss.
- Deterministic, not infallible. The same query with the same rules always gets the same verdict, with no probabilistic models and no variance. Every false positive found is fixed with a regression test, and observe mode lets you try the rules on real traffic before they block.
- Sees what others miss. Multi-statement, data-modifying CTEs (
WITH … DELETE), subqueries and tautology injection (OR 1=1), all over the full AST, multi-dialect. - Measured performance. Evaluation runs in-process in the TCP proxy, with no network calls on the hot path: rule evaluation measured a p99 of 100 µs or less, and the proxy added 0.42 ms at p50 on PostgreSQL with 1 connection (staging, October 16, 2026; a measurement, not a guarantee: conditions and method).
Interception in the PostgreSQL wire protocol
'P' Parse: prepared statements evaluated at the Parse phase, before values are bound. Protection independent of runtime parameters.
'Q' Simple Query: the full statement is evaluated inline before it runs. The destructive query never reaches the database.
Ways to connect
Recommended
TCP proxy deployment
The recommended path: the proxy intercepts the PostgreSQL wire protocol. Transparent protection, no code changes. Deploy it however you like.
HTTP API for CI/CD
Evaluate queries and migrations via REST before deploying, without installing the proxy. Ideal for validating changes in your pipeline.
Languages & ORMs
Any driver that speaks the PostgreSQL protocol works unchanged. Examples for the most-used ORMs and languages.
Not sure which mode to use? See where Vericto sits in nine reference architectures →
Reference
AST rules
Complete catalog of VERICTO-* rules: what they detect, severity, action and supported dialects.
Query examples
Real cases side by side: what gets blocked and why, what passes, and the most common edge cases.
Custom rules
Extend the ruleset with YAML conditions over the AST: schema, node types, conditions, API and preview.
Rule simulator
Simulate new or changed rules against your real traffic before you enforce them (up to 30, 90 or 180 days depending on your plan), from the dashboard or from CI.
Security & community
Security & compliance
Zero-trust architecture, encryption and storage, authentication, evidence for SOC 2 / ISO 27001 audits and vulnerability reporting.
Administrative audit log
Who changed what in the workspace: API keys, members, SSO, policies and billing, with the before and after. Append-only.
Discord community
Join the Vericto community: ask questions, share custom rules and get support from other developers and the team.
Need help?
Can't find what you're looking for or have a use case the docs don't cover? Reach us through the right channel.