vastlint

A high-performance VAST XML validator built on a pure-Rust core. Checks ad tags against the IAB Tech Lab VAST specification so you don't have to read it. Over $30 billion in annual CTV and video ad spend flows through VAST XML, and malformed tags are one of the most common causes of lost impressions, broken tracking, and revenue discrepancies between platforms. There is no widely adopted open-source tool that validates VAST XML against the full IAB specification across all published versions.

Zero runtime dependencies in the core.vastlint-corehas three compile-time dependencies (quick-xml,url,phf) and no runtime dependencies whatsoever — no async runtime, no regex engine, no schema interpreter. Rules are compiled Rust functions. There is no transitive dependency graph to audit, no CVE surface to track, and no supply chain to compromise at runtime.

Apache 2.0 licensed.No CLA, no dual-license commercial upsell, no usage-based restrictions. Fork it, vendor it, embed it, redistribute it.

Dependency update automation.Dependabot monitors Cargo, npm, and GitHub Actions dependencies weekly and opens PRs automatically. Combined withcargo auditon every CI push and CodeQL static analysis on every push and PR, the dependency surface stays current without manual tracking.

Benchmarked on Apple M4 (10-core), production-realistic VAST tags (17–44 KB):

A typical OpenRTB bid cycle takes 100–300 ms; validation adds less than 2.1% of that budget even on the heaviest tags. An SSAI pipeline doing 1,000 stitches/sec spends more time on DNS than on validating the VAST response.

No async runtime, no regex engine, no schema interpreter. Rules are compiled Rust functions. Three dependencies:quick-xml,url, andphf(compile-time hash maps).