---
title: "Check your app against a standard"
description: "Run mainsdk assure against PCI DSS or another standard, see who owns each failure, gate merges in CI, open a pull request of mechanical fixes and keep signed evidence."
section: "guides"
status: "Planned for 0.7"
spec: "assure"
canonical: "https://mainsdk.dev/docs/guides/assure-your-app"
updated: "2026-10-28"
---

# Check your app against a standard

> Run mainsdk assure against PCI DSS or another standard, see who owns each failure, gate merges in CI, open a pull request of mechanical fixes and keep signed evidence.

Status: Planned for 0.7 · Canonical: https://mainsdk.dev/docs/guides/assure-your-app · Updated: 2026-10-28

You will find out where your app fails PCI DSS 4.0.1, see which team owns each failure and by when it is due, fail CI on new failures, and keep evidence an assessor can verify. It takes about 20 minutes. A pass is evidence, not a certification.

## You need

- A MainSDK app with `industry: payments` in `main.yaml` (see [industry packs](https://mainsdk.dev/docs/guides/enterprise-ready)).
- A `CODEOWNERS` file, or an `owners` map in `main.yaml`.

## 1. Run it

```bash
npx mainsdk assure --standard pci-dss-4.0.1
```

Each failing control prints its owner, severity and deadline: critical 7 days, high 30, medium 90. Add `--json` for the same content as data, or `--format sarif|cyclonedx|oscal|pdf` for the other outputs.

## 2. Give failures an owner

```yaml title="main.yaml"
owners: { "app/checkout/**": web-team }
```

CODEOWNERS is read first, then this map. A failure with neither is listed as `unowned`, so it never drops out of a report.

## 3. Record an exception

```yaml title="main.yaml"
exceptions:
  - rule: pci-dss-4.0.1:10.5.1
    reason: Log store migration in progress
    approver: ravi@acme.dev
    expires: 2027-06-30
```

The control shows as excepted until the expiry date and fails again after it. Every exception is written into the evidence. An exception with no reason, approver or expiry stops the run with `MAIN-ASSURE-0001`.

## 4. Gate merges in CI

```bash
npx mainsdk assure --standard pci-dss-4.0.1 --release v1.2   # on the release
npx mainsdk assure --standard pci-dss-4.0.1 --diff --fail-on high   # on every pull request
```

`--diff` shows only failures that are new since the last release, and the run exits 1 when one is at or above the level. This is free in your own CI.

## 5. Fix what a machine can fix

```bash
npx mainsdk assure --standard pci-dss-4.0.1 --fix
```

One pull request changes settings such as `logging.retention`. Judgement calls, such as approving a script on a payment page, are listed and left to a person. Your agent can read the same two lists with the MCP tool `assure.fix`.

## 6. Keep and check the evidence

Every run writes `.mainsdk/assure/latest.bundle`, signed, with the results, SBOM, VEX, policy test results, restore drills and exceptions.

```bash
npx mainsdk assure verify .mainsdk/assure/latest.bundle
```

Pin the signer's public key under `seal.signers` in `main.yaml` and it verifies as `verified`; any changed byte fails with `MAIN-ASSURE-0004`.

## Check someone else's app

```bash
npx mainsdk assure https://orders.example.dev
```

This reads the app's signed `/.well-known/mainsdk.json` and writes nothing. Only the controls the record can answer are judged; the rest are listed as not evaluated. A record whose signature fails exits 2 with `MAIN-ASSURE-0003`.