.svg)
Secure the machinery, not just the software.
Your pipeline runs third-party code with access to your repository, your secrets, and your build — and your source control is itself an attack surface. Heeler treats both as first-class: every action resolved and risk-scored, every workflow reviewed for the misconfigurations that leak secrets, and privileged activity in your organization read straight from the audit log.
Application scanning never looks here.
AppSec tools read the code you ship. They don't read the workflow that builds it, the third-party actions that workflow trusts, or the sequence of administrative actions that quietly removed a branch protection last Tuesday. Each of those is a path to your secrets and your source.
Unreviewed code, maximum privilege
A workflow references an action, that action references more, usually by a mutable tag. All of it runs with access to your secrets, and almost none of it is ever read.
One action, thousands of pipelines
The tj-actions/changed-files compromise leaked secrets from thousands of pipelines at once. A single trusted action turned backdoor reaches everyone who pinned to a tag.
The evidence is in the sequence
When a protection is removed or a repository is cloned forty times in five minutes, nothing in the code looks different afterwards. Only the activity shows it happened.
MAPPED TO OWASP
Mapped to the OWASP Top 10 CI/CD risks.
OWASP publishes a Top 10 for CI/CD security risks — the clearest existing frame for this problem. Heeler's detections map directly onto it, so you can evaluate this against a recognised standard instead of a feature list you'd have to translate yourself.
Insufficient flow control
CICD-SEC-1. Heeler detects a push that bypassed a protected branch, and a pull request created and merged by the same person inside five minutes with no independent review.
Inadequate identity & access management
CICD-SEC-2. Branch protection or a required status check being weakened or removed, and bursts of destructive administrative actions from a single account.
Dependency chain abuse
CICD-SEC-3. Look-alike action names, commits that exist only in a fork, and vulnerabilities inside the packages a JavaScript action bundles.
Poisoned pipeline execution
CICD-SEC-4. Dangerous triggers such as pull_request_target, and expression injection where untrusted event input reaches a shell command — tracked across steps and jobs.
Insufficient credential hygiene
CICD-SEC-6. GITHUB_TOKEN scoped broader than the job needs, cloud-credential requests exposed on public triggers, and secrets committed into workflow files.
Ungoverned third-party services
CICD-SEC-8. Unpinned and unvetted actions, ranked by how much you're trusting the source, with publisher age and marketplace verification folded into a trust score.
Improper artifact integrity validation
CICD-SEC-9. A full commit SHA is a pin; a mutable tag or branch is not. Heeler classifies every reference and checks for a signed build attestation.
Insufficient logging & visibility
CICD-SEC-10. Heeler ingests your GitHub organization audit log and keeps a browsable activity timeline per repository, with 90 days of retention.
THIRD-PARTY CODE
Your pipeline runs code you didn't write.
A workflow pulls in actions the same way your app pulls in packages — and those actions pull in more actions, usually by a mutable tag and rarely reviewed. The tj-actions/changed-files compromise leaked the secrets of thousands of pipelines at once. Heeler treats your workflows as the supply chain they are.
The whole action graph
Every workflow, composite, and reusable action is parsed and the transitive tree resolved several layers deep — into an SBOM alongside your application dependencies.
A tag or branch isn't a pin
Every reference is classified. A full commit SHA is pinned; a v3 tag or a branch can change under you. That's the difference between a frozen dependency and one an attacker can move.
Seven risk signals per action
Pin status, publisher trust, provenance attestation, source health via OSSF Scorecard, a composite trust score you can gate on, known vulnerabilities, and bundled-package CVEs.
Actions that aren't what they claim
Impostor commits pinned to a SHA that exists only in a fork, typosquatted names mimicking popular actions, and actions whose source repository has been archived.
Bundled packages, for JavaScript actions
For JavaScript actions Heeler also tracks the packages the action bundles inside itself, so a vulnerability buried in an action surfaces like any other dependency finding.
Gated at the pull request
Block new unpinned actions, enforce a minimum age so a freshly published release can't slip straight in, and block compromised actions the moment an advisory lands — without failing on what's already in your pipelines.
PIPELINE CONFIGURATION
The misconfigurations that turn a pipeline into an attack path.
The action can be perfectly trustworthy and the workflow around it still hand an attacker your secrets. Heeler reviews the workflow files themselves, and these land in your code-security findings alongside application flaws.
Expression injection
Untrusted input from event payloads, inputs, or job outputs flowing into a shell command — tracked across steps and jobs, not just within one.
Dangerous triggers
pull_request_target and similar patterns that run untrusted code with access to your secrets.
Over-broad token permissions
GITHUB_TOKEN set to write-all, or scoped wider than the job actually needs.
OIDC misuse
Cloud-credential requests exposed on public triggers — a short path from a forked pull request to your cloud account.
Compromised actions, including your own list
Matched against a dedicated actions advisory feed and any list your team supplies — so an internal incident becomes an enforceable rule the same day.
Other hygiene
Secret-exfiltration patterns, self-hosted runner risks, hardcoded credentials, and artifact downloads that are never verified.
ACTIVITY
Heeler's other findings read your code. These read your activity.
A dependency with a vulnerable function is a code problem. Protection being removed from a branch, or a burst of destructive administrative actions from one account, is a behavioural one — nothing in the repository looks different afterwards, and only the sequence of events shows it happened. Heeler reads your GitHub organization audit log and raises findings from patterns in it.
Critical security control changed
High. A branch protection, ruleset, required status check, or vulnerability-alert setting was weakened or removed.
Destructive activity burst
High. Three or more destructive actions — deleting or archiving repositories, transferring them out, destroying protections — hit one repository from one actor inside ten minutes.
Protected branch policy overridden
High. Someone pushed to a protected branch by explicitly bypassing the policy. The detection records the branch, the commits either side, and which policies were overridden.
Rapid repository cloning
Medium. One actor and credential cloned a repository at least five times inside five minutes. Continued bursts stay on one detection, so a sustained campaign isn't dozens of alerts.
Quick unreviewed self-merge
Medium. Someone created and merged their own pull request within five minutes with no independent review in between. Bot accounts are excluded.
Agent-created pull request
Informational by design. A coding agent opened a pull request through an identifiable agent client — it tells you where agent-authored code is entering, not that anything is wrong.
WHAT IT READS
Where this coverage comes from.
Worth being precise about the sources, because they determine what Heeler can and can't see.
GitHub Actions workflows
Pipeline analysis reads the workflow files in your repositories — every action, composite, and reusable workflow they reference, resolved transitively.
The GitHub organization audit log
Activity findings are built on the GitHub organization audit log, available to GitHub Enterprise Cloud organizations and to GitHub Enterprise Server where your appliance serves the endpoint.
JavaScript actions, in depth
For JavaScript actions Heeler breaks out the packages bundled inside. Docker and composite actions are inventoried and risk-scored as units.
90 days of activity history
Audit activity and the detections raised from it are retained for 90 days, measured per repository against its own most recent event — so a quiet repository keeps its last 90 days rather than ageing out.
See what your pipelines actually trust.
A demo connects Heeler to your source control. In your first session you'll see every action your workflows pull in, which are unpinned or compromised, and the privileged activity in your organization you had no view of.
