Guardrails for scaled development

Enterprise engineering teams face an inherent tension: the faster they ship, the harder it becomes to maintain performance, security, and code quality. Vercel's new Conformance and Code Owners features, available for Enterprise customers on its Developer Experience Platform, aim to ease that pressure by automating code review and static analysis within existing workflows.

Conformance runs static analysis across multiple files to identify critical issues before code is merged. Because it checks codebases holistically rather than file-by-file, it can surface problems that may not be visible in isolated review. It classifies and tags issues by severity, provides a dashboard score to track technical debt, and allows teams to allowlist specific issues before production deployment before working to "burn down" that list.

The tooling is built by the teams behind Next.js and Turborepo and applies that framework knowledge to specific rule sets for:

  • Next.js: Catches common pitfalls in Next.js apps—for example, unused getServerSideProps where static generation would suffice.
  • Performance: Detects issues like blocking serial async calls that degrade site responsiveness.
  • Code health: Enforces structural standards such as requiring workspaces with TypeScript to have valid TypeScript configuration.
  • Security: Provides an early threat-detection layer, flagging insufficiencies like missing or invalid security headers in Next.js applications.

Early adopters report significant impact. Teams at Upstart and Origins Digital describe noticeable performance gains—upwards of 200ms across all pages—after addressing the initial batch of flagged issues, along with reduced time spent on debugging.

Code ownership that mirrors the org

Code Owners integrates with Git-based workflows to route code changes to the appropriate reviewers through smart assignment and escalation. The feature follows the organizational hierarchy: code owners higher in the directory tree are responsible for broader areas and act as fallback reviewers if owner files become outdated (e.g., when someone transitions teams).

Organizations can tailor this process with Modifiers. These allow review assignments in round-robin style, by on-call duty, or to the entire team as needed.

A combined approach to security

These two features are designed to pair well. Teams can layer security rules from Conformance with Code Owners policies: the Security team can be assigned as the owner of the allowlist file for Security rules. Any proposal to add a new item to the allowlist then requires explicit Security approval before it takes effect. This extra gate brings security teams into the loop where they otherwise might be bypassed.

A new code health view in the Vercel dashboard

With Conformance comes an updated Vercel dashboard display designed around monorepos. It aggregates project health across repositories, give teams and leadership accessible visibility into overall code health, Conformance scores, and responsible teams within each repo. At one glance, team members can identify problem areas and drill into allowlisted security, quality, or performance errors across the codebase.

More velocity, fewer regressions

Conformance and Code Owners are meant to keep velocity available to large teams without accepting silent—or loud—regressions in product quality. The new features are generally available today for Vercel Enterprise plans.