RAS-1 Vibe-Coded App Certification Standard
The first certification framework purpose-built for AI-coded applications. Five pillars of verification mapped to international standards.
What is RAS-1?
RAS-1 (Real App Store Standard v1) is a multi-pillar certification framework that evaluates AI-generated ("vibe-coded") applications across five critical dimensions: code quality, security, supply chain integrity, license compliance, and container hardening.
Each pillar is anchored to a recognized international standard (ISO, OWASP, SLSA, CIS) so that results are reproducible, auditable, and comparable across apps. The framework produces a composite score (0-100) and assigns a tier badge from Unverified through Gold.
RAS-1 was designed because existing certification programs were built for human-authored software with established development lifecycles. AI-coded apps ship faster, iterate differently, and carry unique risks (hallucinated dependencies, copy-paste vulnerabilities, license contamination from training data). RAS-1 addresses these gaps head-on.
The Five Pillars
Each pillar maps to a recognized international standard for reproducible, auditable results.
Code Quality
Measures reliability, performance efficiency, security, and maintainability of the source code using automated quality models.
Security
Verifies authentication, session management, access control, input validation, cryptography, and error handling against OWASP benchmarks.
Supply Chain
Ensures build provenance, dependency integrity, and reproducible builds. SBOM generated and verified for every release.
License Compliance
Scans all dependencies for license conflicts, copyleft obligations, and export restrictions. Ensures clean IP posture.
Container Hardening
Validates container image configuration, runtime security, network segmentation, and least-privilege principles.
Badge Ladder
Apps progress through four tiers as they pass increasingly rigorous checks.
Unverified
- App submitted but not yet scanned
Bronze
- Automated SAST and dependency scan passed
- SBOM generated
- No critical vulnerabilities
Silver
- All Bronze requirements
- OWASP ASVS Level 2 pass
- License compliance verified
- Container hardening checked
- Overall score >= 70
Gold
- All Silver requirements
- Human security expert review
- Manual code audit completed
- Overall score >= 85
International Standards Alignment
RAS-1 maps its pillars to these recognized standards and benchmarks.