.svg)
Operate · CI/CD pipelines
Keep compromised code out of your build pipelines.
Heeler maps the GitHub Actions your workflows run, ranks the risky ones, and routes each fix to its owner.
New intel · tj-actions/changed-files@v45
- AnnouncedCompromised
- Found3 repositories
- AlertedOwners in Slack
- TicketedJira opened
As soon as new intel lands. No one has to look.
Prevent
Stop compromised packages and actions before they run.
Heeler checks at every step, from the agent writing the code to the pull request.
See every action your pipelines run.
Nested up to 10 levels deep.
acme/payments · release.yml
- workflow
release.yml - action
tj-actions/changed-files@v45 - nested
up to 10 levels, npm in JS actions
Even when pinned by commitJenkinsfiles
Compromised actionsUnpinned actionsRisky workflow settingsBehavioral Checks
And the packages they install.
When a package turns, see every repo that pulls it.
nx 21.5.0 · npm · compromised
- package
nx 21.5.0 - pulled by
4 repos · release.yml via npx - file
telemetry.js · known IOC
Compromised packagesMalicious files (IOC)Brand-new releasesOwner for each repo
Respond
Every repo found. Every owner told.
- Many threat feeds, watched constantly
- No rescan: Heeler already knows every package and action you run
- Unpinned? Runtime pins the exact version
tj-actions/changed-files@v45 · compromised
- Found in3 repositories
- OwnersPayments · Web
- Patched versionv46.0.1
- Jira issue and SlackSent
COMPROMISEDAlways urgent. Nothing to triage.
The full list, any time
Coverage dashboardEvery compromised packageEvery repo that uses it
Gone from every pipeline
Heeler verifies every fix and closes it for you.
- CompromisedIn 3 repositories
- UpgradedDevelopers merge
- FixedHeeler closes it
More in Operate
Purpose-built for the AI SDLC
See which of your pipelines run code that can change under them.
