.svg)
HEAD-TO-HEAD COMPARISON
Heeler vs GitHub Advanced Security.
Agentic Development Security vs SCM-native scanner suite. Both are strong AppSec platforms — built for different eras. Here's where each leads, where they're equivalent, and how to pick for the AI SDLC.
EXECUTIVE SUMMARY
Two strong platforms, two different eras.
GitHub Advanced Security is one of the strongest repository-centric security platforms available — CodeQL, Dependabot, Secret Protection, Copilot Autofix, Security Campaigns, artifact attestations, all native to GitHub. Within the repository boundary, GHAS is excellent.
Heeler was built for the AI SDLC. SAST, SCA, secrets, agent skills security, CI/CD analysis, supply-chain controls, local enforcement, PR guardrails, agent-native workflows, and runtime-aware risk — all running on a shared context engine that automatically assembles six dimensions of context. Prevent, Fix, Audit, and Automate are interfaces on top of one model.
A note on GHAS structure: as of April 2025, GitHub split GHAS into two purchasable products — GitHub Secret Protection and GitHub Code Security. References to “GHAS” below cover the combined scope.
THE FUNDAMENTAL DIFFERENCE
One reasons about a repository. The other reasons about your entire AI SDLC.
Both platforms detect vulnerabilities. The split shows up in what each one knows about your environment when it does.
GHAS
Repository-centric AppSec
Native to GitHub. Excellent within scope.
- →Reasons about code, dependencies, secrets, and (since 2025) Actions workflows inside a GitHub repository
- →CodeQL deep dataflow + Dependabot manifest analysis + Secret Protection across pushes
- →Copilot Autofix and Security Campaigns coordinate developer-led remediation
- →One layer, one SCM, no runtime / deployment / service model
HEELER
Context-engine native, AI SDLC-built
Six dimensions of context, every layer.
- →Multi-SCM (GitHub, GitLab, Bitbucket, Azure DevOps) + multi-cloud (AWS, GCP, Azure)
- →SAST, SCA, secrets, agent skills, CI/CD, supply chain, CLI, PR guardrails, workflows — one engine
- →Context across code, cloud, business, ownership, threat, and agent dimensions
- →Prevent → Fix → Audit → Automate operating on one shared model
VERDICT FRAMEWORK
Side-by-side, with a verdict per row.
Four states. Heeler-leaning where Heeler advances; explicit when GHAS leads; honest about parity.
●
Heeler advantage
Heeler delivers a capability GHAS does not, or in a fundamentally different way that changes outcomes.
◐
Heeler edge
Both deliver the capability. Heeler's implementation is materially better on a verifiable dimension.
✓
Parity
Both products deliver the capability comparably.
○
GHAS advantage
Explicit signal that GHAS leads on this row.
Scorecard — 39 capabilities across 7 sections
| Section | ● Heeler advantage | ◐ Heeler edge | ✓ Parity | ○ GHAS advantage |
|---|---|---|---|---|
| Context engine | 5 | 1 | 0 | 0 |
| Prevent | 4 | 2 | 0 | 0 |
| Fix | 4 | 2 | 1 | 0 |
| Audit | 4 | 2 | 0 | 0 |
| CI/CD supply chain | 2 | 2 | 1 | 0 |
| Automate | 3 | 2 | 0 | 0 |
| Operational fit | 2 | 0 | 2 | 0 |
| Total | 24 | 11 | 4 | 0 |
| Capability | Heeler | GitHub Advanced Security | Verdict |
|---|---|---|---|
| Context engine · the foundation | |||
| Code & dependency context | Build-emulation dependency resolution (no lockfile required); full dep tree (direct, transitive, first-party, bundled); proprietary AST + Symbol Property Graph; cross-function source-to-sink taint; CI/CD modeled as a peer ecosystem with depth-10 transitive walk. | Dependabot graph parses manifests / lockfiles; CodeQL provides cross-procedural global dataflow + taint for supported languages (PHP and Scala not supported). | ◐Heeler edge |
| Cloud & runtime context | Containers, VMs, serverless fingerprinted; each deployment mapped to the exact running changeset; internet accessibility auto-detected; service-to-service connections and data flows modeled. | No documented runtime, deployment, service, or environment model. | ●Heeler advantage |
| Business context | Service tier classification (Tier 1–4) at the application level cascades to every service; environmental boundaries (prod / non-prod) detected automatically; precedence rules across shared repos. | Repository properties can be defined and used as filters (manual labels); prioritization signals: CVSS, EPSS, GitHub-curated advisory data, auto-triage rules. | ●Heeler advantage |
| Ownership context | Automated RACI matrix at application, repo, service, and finding levels; ownership cascade app→service→repo→dep; team import/sync from Backstage, Port, GitHub Teams, GitLab groups, JIRA; contributor de-dupe. | CODEOWNERS for review routing; GitHub Teams for access; Security Manager / Organization Owner roles. | ●Heeler advantage |
| Threat context | GHSA + OSV + NVD/CVE; CVSS v3 and v4; EPSS (score + percentile); CISA-KEV + PhoneCheck-KEV; OSSF Scorecard; OSSF Malicious Packages; behavioral SAST backstop; known-ransomware-campaign flag. | GHSA (GitHub-curated, primary); EPSS score and percentile in alert metadata; CVSS v3; Dependabot malware alerts (npm-focused). | ●Heeler advantage |
| Agent context | Skill catalog of every agent skill in use (skills.md, CLAUDE.md, AGENTS.md); per-skill detection of external binaries, shell commands, secrets, outbound calls; security score per skill. | GitHub MCP server lets AI agents query GHAS findings and benefit from push protection — a consumer of GHAS data, not a skill catalog. | ●Heeler advantage |
| Prevent · stop risk from entering the codebase | |||
| Customer context at every AI-SDLC stage | Same license policy, dep versions in use, security checks, and tier model applied at code generation, pre-commit CLI, PR, and post-merge — no per-tool re-authoring. | Push protection, Dependency Review, Dependabot auto-triage, code scanning merge protection — each separately configured and scoped per repository. | ●Heeler advantage |
| Local pre-commit | Unified CLI: SCA, SAST, secrets, malicious-package detection, license compliance — same engine and policy as the platform. Secret scanning runs offline. | Push protection at the command line for secrets; CodeQL CLI for local analysis and SARIF generation. | ●Heeler advantage |
| Agent skills & MCP at code generation | Security skills auto-load into Claude Code, Cursor, GitHub Copilot, Codex, OpenCode, VS Code via dotagents; skill catalog (Security Review, SAST, Remediation, Secrets, License Compliance) reasons against the same context engine. | GitHub MCP server provides agent-accessible scan tools including push protection scanning of content the agent is about to commit. | ●Heeler advantage |
| PR guardrails | Block / Warn / Observe with plain-English rule authoring; scoping by global, repository, service runtime context, branch; multi-SCM; diff-only on net-new violations; in-PR Fix Now button triggers validated remediation PR. | Dependency Review Action gates PRs by severity, license, and scope; code scanning merge protection blocks PRs on alert severity; Copilot Autofix suggests fixes the developer applies manually. GitHub-only. | ◐Heeler edge |
| Supply chain prevention | Layered defense: posture management, code-generation, local CLI, PR guardrails, post-merge workflows • SCA + SAST together: SCA matches advisory + OSSF feeds; SAST analyzes behavior (obfuscation, C2, postinstall hooks, anti-forensics) • Compromised Dependency guardrail blocks known-malicious at PR; Minimum Dependency Age (2-day) blocks zero-days before they hit advisory feeds • Unpinned Dependency guardrail catches hijacking vector; direct or transitive scope • Catalog + Compromised Dependencies views surface existing exposure across every repo, including transitive instances • Continuous re-evaluation: when a previously-clean dependency is flagged, workflows fire against every deployment running it | Dependabot malware alerts surface malicious dependencies (npm focus on GitHub.com and GHES 3.22+) • Dependency review action: block PRs that add vulnerable packages; deny-licenses and fail-on-severity configuration • Dependabot re-scans existing repositories when a new advisory is added and generates alerts for affected repos • For GitHub Actions, CodeQL's actions/unpinned-tag query flags unpinned action references | ●Heeler advantage |
| Consistent for humans and agents | Same policy at code generation, pre-commit, PR, and workflows • No bypass when code is AI-generated • Enforcement is consistent regardless of which agent (or human) wrote the code | Push protection applies to pushes regardless of whether the content was authored by a human or agent, and the GitHub MCP server exposes scanning to agents pre-push | ◐Heeler edge |
| Fix · solutions, not tickets | |||
| Deterministic upgrade selection | Heeler (not the agent) picks the upgrade using dependency graph + changelog intelligence + breaking-change detection + reachability of called library methods. Walks all code paths. | Dependabot upgrades to the minimum secure version; for npm, can upgrade a parent dependency. Documented limitation: non-npm transitive that requires a parent upgrade is not fixable automatically. | ●Heeler advantage |
| Fixability scoring | Every SCA remediation scored Easy / Medium / Hard via breaking-change analysis; Auto-Fixable label for end-to-end agent execution; Remediation Workbench surfaces environment-wide distribution. | Dependabot alerts include the fixed version where one exists; Copilot Autofix coverage filter exposes a binary autofix:supported signal for campaign scoping. | ●Heeler advantage |
| End-to-end SCA autofix | Engineering teams receive a solution, not a ticket describing a problem — for SCA, end-to-end • Agent creates branch, opens PR, performs upgrade, makes required code changes, validates through CI iteratively, produces a ready-to-merge PR • Validation: compilation testing for compiled languages (Java, Go, C#), sandbox execution for interpreted languages (Python, JavaScript) • CI loop: if a check fails, agent identifies issue, corrects it, pushes fix, re-runs — until lint, unit tests, and integration tests pass • PR ties back to originating Jira ticket and documents dependency changes, validation results, every vulnerability remediated • Every step visible and auditable in the Agent Executions log | Dependabot security updates: opens a PR that updates the manifest/lockfile to a fixed version; the PR runs the repository's existing CI • Dependabot does not iteratively analyze CI failures, correct the code, or re-push the fix | ●Heeler advantage |
| SAST autofix | SAST Auto-fix ships deterministic, validated code-fix PRs — GA. Full taint-flow context (sources, sinks, propagators, sanitizers); a strategy-matched code transform computed from the flaw, built and run through your CI, and opened as a merge-ready PR. Human review; no auto-merge. | Copilot Autofix produces AI-generated fix suggestions on code scanning alerts (CodeQL + third-party scanners that integrate via SARIF); the developer reviews, commits, and merges the suggestion in the PR • Generally available for CodeQL languages with broad rule coverage; quality of AI-generated SAST suggestions is best-in-class within the GitHub ecosystem • Coverage filter (autofix:supported) available for security-campaign scoping — the security manager can scope a campaign to alerts where Autofix can generate a suggestion • Suggestion-based model: the developer applies the fix; not an autonomous remediation PR with CI iteration | ✓Parity |
| Workflow-driven autofix | Workflow can auto-trigger Fix Now on every qualifying new finding — engineering teams receive problem description and solution in same notification • Workflow on "New Remediation Available" trigger removes the human entirely: the moment an auto-fixable remediation is created, the agent is already generating a PR • Run Now executes workflows against pre-existing backlog for bulk burn-down • Parallel execution across the backlog — multiple validated PRs fire concurrently | Dependabot opens security-update PRs automatically when an alert with a fix is generated, where security updates are enabled • Security campaigns let a security manager group up to 1,000 alerts of a class, designate a campaign manager, set a deadline, and route work to developers or assign alerts to the Copilot cloud agent for autonomous PR generation • Copilot cloud agent (newer addition) can attempt the fix and open a draft PR for review — narrows the gap with autonomous remediation • Coverage filter (autofix:supported) available for security-campaign scoping | ◐Heeler edge |
| Automated coordination | Team-based routing — every repository maps to an owning team; one workflow covers the entire organization, no per-team workflow duplication • Tickets route to right Jira/Linear project, notifications hit right Slack/MS Teams/Google Chat channel, content uses team's configured template • Bidirectional ticket integration: tickets auto-close when Heeler verifies fix is not just merged but actually deployed to runtime • Exception management — risk overrides defer or accept findings with documented reason and automatic expiry; on expiry, finding resurfaces for re-evaluation • Adding a new team or repository requires configuration, not a new workflow | Code scanning alerts can be tracked using GitHub Issues for collaboration • Notifications for Dependabot alerts can be routed via email, GitHub UI, or webhooks • Dependabot auto-triage rules can snooze alerts until a patch is available or dismiss indefinitely with a category-based reason • Delegated alert dismissal provides an approval workflow with an audit trail | ●Heeler advantage |
| Fix Now for Guardrail Violations | Fix Now button surfaces directly on guardrail violations in the PR — developer triggers a validated remediation PR without leaving the PR view • No context switch to a separate tool, no copy-paste of a finding ID, no waiting on a separate ticketing workflow | Copilot Autofix surfaces suggested fixes inline on code scanning alerts in the PR; the developer reviews and commits the suggestion | ◐Heeler edge |
| Audit · continuous evaluation | |||
| Continuous risk evaluation | Heeler Risk (Urgent / Plan / Defer) recomputed continuously as code, runtime, and threat data change; factors in reachability, internet exposure, downstream service criticality, exploit maturity, and built-in mitigation checks. | Prioritization via CVSS severity, EPSS score / percentile, repository properties, and auto-triage rules — all from advisory metadata. Re-scans existing repos when new advisory data lands. | ●Heeler advantage |
| Workflow engine | Always-on event-driven workflows: New Finding, New CVE, Compromised Dependency, etc. fire the moment they trigger — unified triage → routing → remediation → runtime SLO closure. | Webhooks for code_scanning_alert, dependabot_alert, and secret_scanning_alert events; Security Campaigns coordinate at-scale remediation through human campaign managers and Copilot agents. | ◐Heeler edge |
| Emerging-risk response | Heeler re-evaluates already-deployed dependencies as new CVEs and exploits drop • Threat factor re-computed continuously — defer can shift to urgent without manual re-triage • Workflow on "New Compromised Dependency" auto-routes to the team owning the affected service • Fingerprinting identifies every deployment running the affected version | Dependabot generates new alerts on all affected repos when a new advisory is published | ●Heeler advantage |
| SLO Management | SLO clock starts at first detection (static or runtime) • Closes only when Heeler verifies resolution at runtime — not at PR merge • SLO strategy options: risk-based (Heeler Priority) or CVSS severity-based • SLO Override workflow extends deadlines when no fix exists, resets when fix becomes available • SLO Guardrails block PRs against repos with overdue findings • Compliance reporting reflects actual exposure, not ticket state | Average alert age and alert remediation rate tracked in Security Overview dashboard (Detection and Remediation tabs) | ●Heeler advantage |
| Lifecycle finding states | Active: in code, not yet resolved • Fixed: remediated in code, not yet fully deployed • Deployed: resolved and no longer in any active deployment • Resolved-Issue view retains MTTR, resolved reason, resolved date • Distinguishes introduced (new dependencies brought vulnerabilities in) from surfaced (existing code, new advisory) | Code scanning alert states: open, dismissed (with documented dismissal reasons), fixed • Dependabot alert states: open, fixed, dismissed, auto-dismissed; auto-dismissed alerts can be reopened • Secret scanning alert states: open, resolved (revoked, false positive, used in tests, won't fix, pattern deleted, pattern edited) | ●Heeler advantage |
| Refactor-resilient issue persistence | Cross-scan issue matching survives code movement, file renames, and refactors • Same vulnerability tracked accurately even as code evolves • Commit-level attribution: who introduced, when, and how it evolved | Code scanning alert tracking with GitHub Issues for collaboration | ◐Heeler edge |
| CI/CD supply chain | |||
| Workflow & action inventory | Parses every workflow YAML; depth-10 transitive walk across composite + reusable workflows; JS-action npm dependencies spliced into the repo's npm graph; CycloneDX SBOM with pkg:github-action purls; SHA-exact matching. | Dependency graph + Dependabot recognize the github-actions ecosystem; reusable workflows tracked at level-1; SPDX SBOM via UI / REST API. Documented limitation: Dependabot Actions alerts fire only on semver-pinned actions, not SHA pins. | ●Heeler advantage |
| Action risk scoring | Pin status (only 40-char SHA counts), publisher trust + account age, SLSA attestation presence on resolved SHA, bundled-npm CVEs inherited via SCA path. | CodeQL actions/unpinned-tag query flags unpinned references (composite action.yml analysis added in CodeQL 2.25.5); Enterprise / org policy restricts allowed actions to verified creators or a list. | ◐Heeler edge |
| Workflow security analysis | Static checks on workflow YAML + action source; lands in repo SAST triage flow • Unpinned actions tiered by origin (third-party / first-party / GitHub-owned) • Excessive GITHUB_TOKEN permissions (write-all, scope-level, missing defaults) • OIDC misuse: id-token: write on public triggers, templated cloud roles (AWS role-to-assume, GCP WIP) • Dangerous triggers: pull_request_target, ungated issue_comment, workflow_run escalation • Expression-injection taint engine — true source-to-sink across steps + jobs, not regex • Secret exfil, self-hosted runner risks, hardcoded creds, git-credential URL injection | CodeQL Actions query suite (default + security-extended), GA April 2025; runs as real source-to-sink taint tracking on workflow YAML (not regex) • actions/code-injection — expression injection (sources: github.event.*, inputs.*, needs.*; sinks: run:, action with: params) • actions/envvar-injection — environment-variable injection via $GITHUB_ENV • actions/untrusted-checkout — pwn-request patterns (pull_request_target + checkout-of-PR-head; workflow_run trust boundary) • actions/missing-workflow-permissions — no explicit permissions block (GITHUB_TOKEN least-privilege) • actions/unpinned-tag — actions referenced by mutable tag rather than SHA • CodeQL Actions findings land as code scanning alerts in the same Security tab as other CodeQL findings | ✓Parity |
| Workflow guardrails | Block PRs that introduce unpinned actions • Enforce minimum dependency age (cooldown) on actions and their bundled npm packages — defends against attacks installing freshly-published malicious versions • Block or warn on compromised actions automatically when a matching GHSA advisory or operator-supplied entry lands • Standard CI/CD hygiene checks enforced at PR time • Workflow findings feed the same guardrail mechanism that gates repo dependencies | Block PRs on unpinned actions: achievable via code scanning merge protection on actions/unpinned-tag severity • Dependency review action can fail PRs on advisory severity (covers Actions advisories with semver matching) • Allowed-actions enterprise/org policy can restrict which actions can run at all — platform-level execution restriction • Documented limitation: blocking PRs on compromised actions is subject to the SHA-pinning gap — Dependabot Actions alerts fire only on semver pins; if you SHA-pin (best practice), alert-driven block does not fire | ◐Heeler edge |
| Unified CI/CD risk management | Filter the catalog or findings views by GitHub Actions to scope to CI/CD • Findings route through CODEOWNERS-based ownership, same as repo-dependency findings • Remediation runs through the existing automated-workflow infrastructure • One data model, one risk score, one set of guardrails across repo code and CI/CD | Workflow findings (CodeQL Actions queries) land as code scanning alerts alongside other CodeQL findings; Actions vulnerability matches land as Dependabot alerts — two separate alert types managed in two separate UIs • CODEOWNERS routes PR reviews, including workflow file changes • Security Overview includes both code scanning and Dependabot metrics in org-level dashboards | ●Heeler advantage |
| Automate · response at machine speed | |||
| Automated team & ownership routing | Teams configured once: repositories, members, ticketing provider, templates • Providers: Jira, Linear, Shortcut • Messaging: Slack, Microsoft Teams, Google Chat, Email • Assigned Team routing — one workflow fires for all teams, routes to each correctly • New repos picked up automatically when added to GitHub team or GitLab group • Missing-team fallback configurable per workflow (Skip or Fallback) | CODEOWNERS routes review requests on PRs to the responsible team • GitHub Teams + repository permissions provide the access model used by GHAS roles (Security Manager, etc.) | ●Heeler advantage |
| Automated SLO lifecycle | SLO clock starts at first detection (static or runtime), closes when resolution verified at runtime • SLO Override action extends deadlines when no fix exists, resets when fix becomes available • SLO Expiring trigger alerts teams as deadlines approach, escalates when overdue • SLO Guardrails block PRs against repos with overdue findings • Configurable severity-based overdue thresholds (e.g., Critical = 0 days, High = 7 days) | Security Overview displays alert age, MTTR, and remediation rate metrics, with trend indicators | ●Heeler advantage |
| Template-driven ticket content | Per-team Jira / Linear / Shortcut templates with Jinja2 variables • Pre-populates: finding ID, severity, repo, service, dependency graph, reachability, available remediation, direct link back to Heeler • Per-team template overrides per trigger + action combination • Field defaults type-checked against the ticketing provider's schema • Deduplication: workflows do not create a second ticket for the same entity | GitHub Issues can be created from code scanning alerts for collaborative tracking | ●Heeler advantage |
| Exception management at scale | Exceptions granted via UI or ignore files (.heeler.yaml policy-as-code) • Scoped by category, provider, package, or specific finding • Bulk exceptions for accepted risk • Audit log retains every exception decision for compliance • Snyk .snyk ignore-rule import for migration | Dependabot auto-triage rules: GitHub-preset rules + custom rules for dismiss / snooze / open-PR scoped by alert metadata; rules apply to future and current alerts and provide bulk effect • Delegated alert dismissal: reviewers can approve dismissal requests, providing an audit trail • Dismissal reasons for secret scanning alerts • Snooze until patch is available documented for Dependabot auto-triage | ◐Heeler edge |
| The leverage outcome | AppSec operates at the velocity of AI code generation • Triage, routing, ticketing, remediation, SLO — all execute without a human in the middle • Same automation pipeline applies whether code is human-written or agent-generated • Security engineers spend time on decisions, not coordination | Security campaigns + Copilot Autofix + Copilot cloud agent assignment together create a meaningful at-scale remediation program • Campaign-driven model: security manager scopes a campaign, sets a deadline, and routes work to developers or to AI agents that generate draft PRs • Agent-assisted remediation narrows the gap with autonomous burn-down, but throughput is still bounded by campaign-scoping cadence and developer review of agent-generated PRs | ◐Heeler edge |
| Operational fit | |||
| SCM coverage | GitHub, GitLab, Bitbucket, Azure DevOps — one platform across them all. | GitHub only. GHAS runs natively inside GitHub; external CI integrations send SARIF. | ●Heeler advantage |
| Cloud / runtime coverage | AWS, GCP, Azure. Sensor-less inventory. | No documented cloud / runtime model. | ●Heeler advantage |
| API access & data export | API-first architecture; UI runs on the same APIs customers use; full surface-area parity. | REST + GraphQL API covers code scanning, Dependabot, secret scanning alerts, dependency graph, SBOM export, security overview filters; webhook events for all three alert types. | ✓Parity |
| Identity & onboarding | GitHub App: two-click install • SSO and SCIM provisioning supported (SAML) | SSO (SAML), SCIM, and Enterprise Managed Users available on GitHub Enterprise Cloud • Per-repo and per-org GHAS enablement; org-scale rollout via security configurations and the GitHub-recommended security configuration | ✓Parity |
WHERE HEELER ADVANCES
Six places the AI SDLC needs more than a repository view.
Every one of these maps back to the context engine — not features bolted onto a scanner.
01
Multi-SCM, multi-cloud
GitHub, GitLab, Bitbucket, Azure DevOps. AWS, GCP, Azure. One platform regardless of where your code lives or runs — no GitHub lock-in.
02
Six dimensions of context
Code, cloud, business, ownership, threat, and agent context — connected once, used everywhere. GHAS reasons within the repository boundary; Heeler reasons across your entire stack.
03
Deterministic Agentic Remediation
Heeler ships validated, merge-ready PRs for both SCA (dependency upgrades) and SAST (code) findings — each built, run through your CI, and repaired until green. Copilot Autofix only suggests; Heeler ships. Throughput scales with code-generation velocity, not developer review capacity.
04
Runtime-aware risk scoring
Risk recomputes continuously as code, runtime, and threat change. Reachability, internet exposure, service tier, and downstream impact — not just CVSS + EPSS from advisory metadata.
05
Agent skills security
Inventory every skill your AI agents load (skills.md, CLAUDE.md, AGENTS.md). Detect external binaries, shell commands, secrets, network calls. Score per-skill risk. GHAS has no agent-skill catalog.
06
Always-on workflows
Triggered the moment a finding or CVE appears — no campaign-scoping meeting, no developer-review bottleneck. GHAS campaigns are excellent program management; they aren't autonomous.
WHERE GHAS LEADS
Where GHAS is the right choice.
A fair comparison shouldn't only point one direction. GHAS has real strengths — here are the ones to weigh.
Native GitHub experience
Alerts surface in the GitHub UI alongside code. No separate platform to operate, no separate identity to manage, no second product for developers to learn. If GitHub is your one source of truth, that's worth a lot.
CodeQL depth in scope
CodeQL is one of the strongest static analysis engines available for its supported languages (C/C++, C#, Go, Java/Kotlin, JS/TS, Python, Ruby, Rust, Swift, Actions). Cross-procedural global dataflow with custom-query support via CodeQL packs.
Free for public repositories
Dependency Graph, Dependabot alerts and security updates, SBOM export, artifact attestations, and partner secret scanning remain available on free plans for public repositories. Hard to beat free for OSS maintainers.
HOW TO DECIDE
When to choose which.
The decision rarely comes down to a single feature. It's about which kind of platform fits your environment, your team, and your code-generation velocity.
CHOOSE HEELER IF YOU
Need security that reasons about more than a repository.
- •Use multiple SCMs (or plan to), or aren't fully GitHub-committed
- •Have AI coding agents (Claude Code, Cursor, Copilot, Codex) writing code at scale
- •Need security context from cloud, runtime, and business — not just the repo
- •Need autonomous burn-down that scales with code-generation velocity, not developer review capacity
- •Manage shared dependencies across services with different criticality tiers
- •Want PR guardrails authored by AppSec in plain English, not YAML or Rego
CHOOSE GHAS IF YOU
Are GitHub-committed and the repository view is enough.
- •Use GitHub exclusively and have no plans for GitLab, Bitbucket, or Azure DevOps
- •Want one product across code and security, native to GitHub's UI
- •Need CodeQL specifically for its language coverage and custom queries
- •Don't need a runtime, deployment, service, or environment model
- •Are comfortable coordinating remediation through human-driven Security Campaigns
- •Maintain public repositories and want a strong free baseline
See Heeler on your codebase.
A demo runs Heeler against your real repos and shows the prioritization, remediation, and workflow outputs. Side-by-side with what GHAS produces, if useful.
