.svg)
Solutions
Demonstrate accountability, resilience, and measurable risk reduction
Owners, controls and evidence on record. Ask for any report.
Build our Q3 board report.
heeler
portfolio_posture_summaryslo_queueguardrail_blocked_prs
Board report · Q3
Urgent18
Past SLO12
PRs blocked37
The challenge
Who owns each risk, and can we prove controls work?
- Owner per risk
- Fixed in production
- Evidence for the audit
Ownership
Every risk has an owner and a deadline.
Each finding goes to the team that owns the code, with an SLO set by its priority.
Owner from CODEOWNERS, ownership files or SCM teams
Urgent fixed within 14 days by default
Deadlines watched by workflows
SLO queue · acmeUrgent and Plan
FindingOwnerSLO
SQL injectionorders/query.py:88 · Urgent
Team OrdersPast SLOcommons-text 1.9CVE-2022-42889 · Urgent
Team Orders6 days leftjackson-databind 2.9.1014 advisories · Plan
Team Payments41 days leftFixed in production
Fixed means deployed.
A finding closes only when production runs the fix. The SLO clock stops there.
Fix PRs validated in your CI
Deployed when every deployment runs it
SLO clock stops at resolution
commons-text 1.9 → 1.10.0SLO met
Activefound Sep 12
FixedPR #482 merged Sep 15
Deployed3 of 3 deployments
orders-api · prod-usSep 16
orders-api · prod-euSep 16
orders-worker · prod-usSep 17
Decisions
Every exception and change on record.
Exceptions carry a reason and a due date. Policy changes are logged with the user and the time.
Exceptions with a reason and a due date
Audit Log of policy and config changes
Any of it on demand, through the MCP Server
SLO exceptions2 active
lodash 4.17.20web-admin
Not in productionDue Dec 1openssl 3.0.7legacy-batch image
Replacement in Q4Due Nov 15Audit Log
Oct 2a.patelAgent File Change: Warn → Block
Oct 1j.ruizSLO for Urgent: 14 days on Tier 1
Sep 29a.patelGuardrail scope: Tier 1 and Tier 2
Evidence
Mapped to your standards.
Findings, SLOs and guardrails count as evidence for the standards you report on.
OWASP ASVS 5.0.0, EU CRA and DORA
AWS FSBP and CIS benchmarks per cloud account
SBOM as CycloneDX, or SPDX for images
Standards report · October 2026PDF · CSV
OWASP ASVS 5.0.0
EU Cyber Resilience Act
DORA
Verified by Heeler
Needs attestation
Also on record
CloudscoreAWS FSBP and CIS benchmarks, per account
DatareportGDPR, CCPA, HIPAA, PCI DSS, SOX fields in code
SBOMexportCycloneDX, or SPDX for container images
Show who owns risk, and that it falls.
