Straightedge SI

The layer between AI/SI and what it builds.
Playground: 3j8kPHuN6dXqUdxrXY5XiMYG71sHbyng9AjwQ5V5pump

[Straightedge SI @straightedgesi]

Straightedge, explained so simply that anyone gets it.

Imagine a robot that can build houses. You tell it "build me a house" and it builds one in a minute.
Amazing. But the robot learned by looking at millions of pictures of houses, and a lot of those were drawings, toys and movie sets.

So the house looks fine, but the front door has no lock, the stairs have no railing, and the wires are taped to the wall.

That is what happens today when an AI writes software. It looks done. It is not safe.

Straightedge is a rulebook that the robot has to read before it starts building. Every door gets a lock. Every stair gets a railing. Every wire goes inside the wall. One typeface, one accent color, so the house also looks calm instead of loud.

The robot does not get smarter. It just stops forgetting the boring important stuff, because the rules are in its hands before it picks up the first brick.

That is the whole idea.
A rulebook between the robot and the house.

https://t.co/8TIrXXwuWa

[Straightedge SI @straightedgesi]

Proud to announce that we were invited to the @AnthropicAI startup program!

We now have access to Mythos and will be able to make Straightedge even better

[Straightedge SI @straightedgesi]

We just applied as an business on X!
The golden badge is now under review and will be there in a few days

[Straightedge SI @straightedgesi]

Part 2 has 33 rules. The first two of every section are public on the site. A few of them, so you can judge the level of detail.

Credentials travel in the Authorization header. Tokens and API keys never appear in URLs, query strings or logs (CWE 598).

Errors use one format across the whole API: Problem Details as defined in RFC 9457, with a stable type, a title and an HTTP status.

Error responses never contain stack traces, query text, file paths, internal hostnames or library versions (CWE 209).

The API is versioned in the path, and a version is never changed in a way that breaks existing clients.

HTTP methods keep their meaning. GET and HEAD never change state. PUT and DELETE are idempotent. A POST that moves money accepts an idempotency key (RFC 9110).

Cross origin requests are allowed only from an explicit list of origins. A wildcard origin is never combined with credentials (CWE 942).

Authentication success and failure, authorization failure, rate limit hits and validation failures are logged with a request identifier, a timestamp and the acting principal (CWE 778).

Every one of these is a thing an assistant gets wrong by default, and every one of them is a sentence long.

[Straightedge SI @straightedgesi]

We will also have a livestream!

Full showcase of Straightedge

[Straightedge SI @straightedgesi]

Time to get it started..

Some honest words from me (founder and also developer)

Worked on a huge project back in 2021 (Ethereum), always utility guy

Wanted to work on my own project now, asked many people which blockchain is the most active one -> Solana

But I didn’t expect the on chain utility space to be this dry

So here it comes: We will release the 1,0 full version today, not tomorrow!

We will also start buying our own tokens and locking them so it gets bonded

We are here for real utility.. the 0,1%

[Straightedge SI @straightedgesi]

Part 1 ends with a list of things that are never allowed. It is the most quoted section, so here it is in full.

Gradient backgrounds behind text, in buttons or on cards. More than one typeface, excluding monospace for code. Font weights other than 400 and 600. More than one accent color. Semantic colors used for decoration. Emoji in interface chrome. Exclamation marks in interface copy. Glow effects, neon borders, outlined text and text shadows. More than two levels of shadow. Hover effects that scale, lift or rotate elements. Transitions longer than 400 milliseconds. Autoplaying carousels and looping decorative animation. Text over imagery without a solid scrim. Spacing values that are not on the eight point scale. Shipped placeholder text.

If you have ever asked an assistant for a landing page and received a purple gradient hero with a glowing button and three emoji in the nav, you understand why the list exists. The model reads this once and the gradient never comes back.

[Straightedge SI @straightedgesi]

Last time we will comment about the "bonding"
Got some several dm's

We will make sure it will bond, don't worry 📐

[Straightedge SI @straightedgesi]

Our Straightedge SI Chrome Extension will also be available off tomorrow!

You will be able to use Straightedge with @AnthropicAI @OpenAI and @cursor_ai!

We will add more by time.

[Straightedge SI @straightedgesi]

straightedge.css

The interface part is not just prose. Every value in it is published as a stylesheet: straightedge.css, generated from the same source file as the text of the standard, so the two cannot drift apart.

What is inside. Custom properties with the se prefix for the font stack, the full type scale with size, line height, weight and tracking per level, thirteen color tokens with a light and a dark set, the spacing scale, four radii plus a pill radius, shadows, motion durations and easing, and layout widths.

How it is used. The assistant gets one instruction: use only the values defined in straightedge.css for anything rendered. No arbitrary hex codes, no 13px here and 15px there, no custom easing. If a value is not a token, it is not allowed.

That one constraint is what makes generated interfaces come out consistent. The model is not asked to have taste. It is asked to pick from a short list.

Both files, STRAIGHTEDGE.md and straightedge.css, are downloadable from the site without an account. The standard text is CC BY 4.0, the stylesheet is MIT.

[Straightedge SI @straightedgesi]

@CJGRIFFITHS11 This is actually not shit.
It's a useful tool for developers to create safe and quality infrastructure for their projects out of the box!

[Straightedge SI @straightedgesi]

Why Straightedge SI changes the economics of generated code, in technical terms.

An assistant samples the most probable continuation of its context. Its prior over how an endpoint, a query or a cookie is written comes from a corpus dominated by tutorials, where auth is omitted for brevity, secrets are literals and errors print their stack. Left alone, the model reproduces that prior at scale. Every scanner, linter and audit in your pipeline is a post hoc classifier over output that already encodes those defaults.

Straightedge moves the constraint from the output side to the context side. Two files in the repository, read at session start through the instruction file every major assistant already honors, put 117 rules in the context window before the first token is generated. The rules are phrased as hard constraints, not preferences: every endpoint authenticated unless allowlisted (CWE 306), object level authorization in the handler (CWE 639), schema validation with unknown field rejection at the boundary (CWE 20), parameterized queries only (CWE 89), Argon2id for passwords (CWE 916), cookies Secure HttpOnly SameSite and never Web Storage (CWE 922), a Content Security Policy with default-src self and nonce or hash for inline script (CWE 693), Problem Details per RFC 9457 for every error, idempotency keys on state changing POST per RFC 9110, pinned dependencies with a lockfile and a failing audit threshold (CWE 1357, CWE 1395).

Each rule is one sentence, deterministic to check, and cites the weakness or standard it derives from. That gives you three properties you do not get from a style guide: the model can apply the rule to cases it does not literally mention because the rationale is in context, a reviewer can verify compliance line by line, and the standard is versioned so a change in a rule is a diff, not a vibe.

On the interface side the same mechanism collapses the design space to a token set: one font stack, two weights, thirteen color tokens in two schemes, an eight point spacing scale, four radii, three durations. The model stops choosing and starts selecting.

Net effect: the secure and consistent output becomes the maximum likelihood output. Prevention at generation time, verification at review time, zero runtime cost.

https://t.co/8TIrXXwuWa

[Straightedge SI @straightedgesi]

Of course, it will be even better off tomorrow

[Tim420Time @TTime62019]

Works fine! :)

[Straightedge SI @straightedgesi]

Where we are.

Straightedge SI is in the last phase before the full 1.0 release. The five parts are written. The files are generated from one source, so the text and the stylesheet cannot disagree. The playground has been building pages for strangers all day, light and dark, and the results are public, the good ones and the bad ones. The site, the docs, the whitepaper and the legal pages are up.

What we are doing right now: reading every rule one more time against the sources it cites, checking the prepared instruction files for each assistant, and preparing the release itself so tomorrow it is one switch, not a scramble.

Tomorrow: 1.0 goes out, all five parts in full. And tomorrow marketing starts. Until now we have posted nothing and bought nothing. From tomorrow we will explain the standard piece by piece, in public, one post per part.

If you want to be early, the free part and the playground are already there.

https://t.co/8TIrXXwuWa

[Straightedge SI @straightedgesi]

Second principle. Input is checked against a schema before it is used.

What that means in practice: bodies, query parameters, path parameters, headers, uploaded files and queue messages are validated where they enter the system. Types and sizes are enforced there. Unknown fields are rejected, not ignored. The interior of the system trusts only values that passed the boundary.

Why: injection, path traversal and resource exhaustion all begin with a value that was used before it was checked. If the check happens in one place, at the edge, every handler behind it is simpler and safer.

The Part 2 input rules add the detail an assistant usually forgets. Maximum sizes for bodies, arrays, strings and uploads are set at the framework or the proxy, not only in the handler (CWE 400). A handler that validates perfectly is still a problem if a 2 GB body reaches it.

The Part 4 counterpart: input is validated in the browser for usability and again on the server for safety. Client validation is never the only validation (CWE 602).

[Straightedge SI @straightedgesi]

The first layer BETWEEN AI/SI and output.
Never been built before, but it's time.

Tired of seeing vibe-coded applications getting hacked.
By using Straightedge you get rid of it

[Straightedge SI @straightedgesi]

Back online as promised!

[Straightedge SI @straightedgesi]

We want everyone to understand what Straightedge SI is

So.. feel free to ask in this comment section and we will reply to every question!

[Straightedge SI @straightedgesi]

We just bought the highest possible plan of @AnthropicAI!

We will be back online with our playground in a few minutes.

We didn't expect this high usage at the beginning, impressive! 📐

[Straightedge SI @straightedgesi]

Nope, we are just switching the account and upgrading it.

Will be back in a few minutes

[Straightedge SI @straightedgesi]

The first principle, in full, because it is the one that would have prevented most of the breaches you read about.

Every endpoint requires authentication unless it is listed in an explicit public allowlist in the codebase. Every handler checks authorization for the specific object, not only whether someone is logged in. Every network path is closed until opened. A missing check fails the request.

Why it is first: most breaches are not clever. They are a route that nobody protected because the default was open. Someone added an admin endpoint during a late session, the middleware was not applied, nobody noticed because the frontend never linked to it. An assistant does exactly this, at scale, with confidence.

In Part 2 this becomes concrete rules. Authentication rule one: every endpoint requires authentication unless it is on the allowlist (CWE 306). Authorization rule one: the handler checks that the caller may act on that specific object (CWE 639, CWE 862). Authorization rule two: hiding a control in the interface is not an access control (CWE 602).