.svg)
Fix everything you can — deterministically.
AI attackers chain low-severity findings into novel exploits in minutes — deferring isn't safe anymore. Heeler burns down the backlog and responds the moment new CVE research lands: it selects the safest deterministic upgrade, validates it through your build and CI, and opens a merge-ready PR.
Remediation stalls in two places
Deciding which version to move to, and doing the work. Auto-bump bots pick “latest” and break the build; chatbot fixers let a model choose the version and hope. Both push the judgment back onto your engineers.
“Just upgrade to latest”
Auto-bump bots grab the newest tag — pulling in new breakage, new CVEs, and major-version churn nobody asked for.
A model guessing the version
Chatbot fixers let an LLM choose what to upgrade to. Now your security outcome depends on a guess you can't audit or reproduce.
Deferring instead of fixing
So the backlog gets “prioritized” while dependencies age, upgrades get harder, and the eventual jump is bigger and riskier.
Select. Apply. Validate.
Heeler computes the fix — not the model
For each vulnerable dependency, Heeler uses your dependency graph and active CVE data to pick the version with the highest security impact and the least breaking-change risk — not the latest tag. It respects your minimum package-age policy, and for transitive CVEs it finds the smallest direct-ancestor upgrade that resolves them out of your tree.
- Lowest version that clears the CVEs and adds no new ones
- Weighs security impact against breaking-change risk
- Transitive fixes via the smallest direct-ancestor bump (npm, Go, Cargo, CocoaPods, JSR, Swift)
- Reproducible and auditable — computed from your graph and CVE data, not a prompt
An agent does the work, in a governed loop
The agent applies Heeler's exact target version — editing manifests, lockfiles, and any first-party code the upgrade breaks. It validates the build and dependency resolution with ecosystem-specific checks, then runs your CI. If checks go red, a repair loop pushes fix commits to the same PR until they pass.
- Branch off your base commit; your CI runs on the PR
- Repair-on-red loop — up to 5 attempts to get CI green
- Abstains when uncertain — can't build it clean? It aborts and tells a human what to do
A documented, merge-ready PR
Every PR states the impact, the changes made, how it was validated, and the exact CVEs resolved. If the agent had to deviate from the requested version, it documents why — with evidence the substitute still clears every CVE. PRs require human review by default; Heeler never auto-merges.
- Impact, changes, validation, and CVEs fixed — in the PR body
- Human review required by default; skip-review is opt-in per trigger
VALIDATION
The CI Testing Loop
Heeler doesn't just generate fixes — it validates them through your existing CI pipeline, so every change is safe, functional, and merge-ready without manual intervention. Heeler has no runtime access to your code; validation runs in your own CI.
The Heeler agent generates the upgrade, applies the necessary file and code changes, and opens a pull request with the full set of modifications.
Your CI pipeline runs automatically on the PR. Heeler waits for all checks — build, tests, and any other configured steps — to complete.
Heeler collects the full set of results and attributes any failures to the changes introduced by the upgrade.
On failure, a new agent run is triggered with the failing results, build errors, and PR context. It fixes compilation issues, resolves failing tests, and adjusts code or configuration — then pushes updated commits to the same PR, re-triggering CI.
If the agent can't fully resolve the issue, Heeler comments on the PR explaining what couldn't be resolved automatically — with all intermediate commits, CI results across every attempt, and a link into Heeler for deeper inspection.
All CI checks pass — the PR is ready for review.
Up to 5 additional remediation commits are attempted before handoff.
The agent determines the issue is unlikely to resolve automatically and hands off.
DETERMINISTIC × AGENTIC
Deterministic where it counts. Agentic where it helps.
The security decision is math, not a prompt. The labor is an agent's — inside a governed loop that abstains when it's unsure.
Heeler computes — no LLM
- Whether a finding is auto-fixable (language and upgrade type)
- Which exact version to upgrade to — minimal viable, fewest new CVEs, most cleared
- Which direct ancestor to bump to resolve a transitive CVE
- The size and breaking-change risk of the upgrade
- Batching, the hold window, and the human-review gate
The agent does
- Applies the exact version Heeler chose
- Edits manifests, lockfiles, and the first-party call-sites the upgrade breaks
- Validates the build and dependency resolution, then runs your CI
- Fixes CI breakage in a repair loop (up to 5 attempts)
- Writes the PR — and aborts to a human when it can't finish cleanly
Shipping today for both dependency (SCA) and code (SAST) remediation. SCA: Java and Go by default; JavaScript/TypeScript, Python, and C# under feature flag; patch and minor upgrades by default, majors opt-in. SAST Auto-fix delivers deterministic, validated code-fix PRs for supported finding types.
Heeler fixes the code you write, too.
You've just seen how Heeler fixes the dependencies you import. Its other half — SAST Auto-fix — fixes the code your team and your agents write: a deterministic, strategy-matched transform anchored to the taint path, validated in your build and opened as the same merge-ready PR. One context engine, one prioritization model, one workflow — across both halves of your codebase.
Explore SAST Auto-fix →See it fix a real CVE in your repo.
Connect a repo and watch Heeler compute an upgrade, validate it, and open the PR — in your first session.
