VerifyPatch executes code.We do not pretend that means it is sandboxed.
Repository tests, imports, fixtures, and dependencies are potentially untrusted code. VerifyPatch is designed for isolated CI environments with minimal permissions and no secrets exposed to pull-request execution.
What the product does not claim
The core product does not require an AI model. It does not prove correctness, identify who wrote a test, or sandbox the code it executes. Do not run untrusted pull requests on a reusable self-hosted runner unless it is strongly isolated and disposable.
Never put a provider key in the untrusted job
Tests, conftest.py, imports, build hooks, and dependencies can read that job's environment. Optional requirement extraction uses a two-job split.
Trusted job
Allowlisted requirements and docs only
Provider API
Validated requirements artifact
Secret boundary
Untrusted job
Patch + pytest + VerifyPatch
No provider credentials
Recommended CI shape
- Trigger on pull_request, never pull_request_target.
- Use permissions: contents: read.
- Check out enough history to resolve both revisions.
- Avoid secrets in the job that runs repository code.
- Use an ephemeral GitHub-hosted runner and an explicit timeout.
- Upload the JSON and Markdown reports.
Policy
Policy is informational unless the command includes --enforce. Null or incomplete metrics cannot satisfy configured numeric thresholds.