.svg)
Agents write your infrastructure too.
AI coding agents generate Terraform and Kubernetes manifests as readily as application code — and a misconfigured resource isn't a bug, it's a door left open. Heeler analyzes every infrastructure definition in your repositories, ties each misconfiguration to the resource it actually builds, ranks it by what that resource is exposed to, and blocks new ones at the pull request — before anything is stood up.
A misconfiguration doesn't need an exploit.
An infrastructure defect needs no vulnerability and no attacker toolchain — the resource is simply configured to allow it. And because definitions read like settings rather than logic, they clear review faster than the application code they stand up.
Config clears review faster
A Terraform diff reads like settings, not logic — so it moves through review faster than the application code it provisions, with a far larger blast radius.
Severity without the resource
“High severity in main.tf” tells you nothing. Which bucket? Reachable from where? Without the resource behind it, every finding looks identical.
Found after it's already running
Cloud posture tools catch the misconfiguration once it's deployed. By then it's a change request, an approval, and a window where the door stood open.
Every misconfiguration, tied to the resource it builds.
Heeler reads your definitions and records the concrete resource each one provisions — an S3 bucket, a security group, a Kubernetes deployment — then scores the finding against the service and environment that definition actually stands up. That's the difference between “a Terraform file has a High finding” and “this bucket is public.”
Five frameworks, one model
Terraform, OpenTofu, CloudFormation, Pulumi, and Kubernetes manifests — analyzed into the same finding model, so one policy covers every one of them.
Filter by resource type
Every finding carries the resource it evaluated, so “every public-bucket finding across all forty repositories” is one filter rather than an afternoon of grep.
Ranked by real exposure
The same misconfiguration is Urgent on an internet-facing production service and Defer in a sandbox. Heeler scores it against where the resource actually runs.
Its own section, not buried in SAST
IaC findings never mix into your code findings — separate lists, separate filters, separate exports. Infrastructure work goes to the people who own infrastructure.
Every finding comes with the change to make.
Heeler doesn't stop at “this bucket is public.” It supplies the exact change to the definition — encrypt this volume, scope down this ingress rule, drop this privilege — as a concrete before-and-after, sized to the smallest safe edit.
Before and after
The misconfigured resource block and the corrected one, side by side — not a link to a generic advisory.
The right change
Encrypt, restrict, or scope down — Heeler picks the correct remediation for the resource type and the framework it's declared in.
Proportional
Fixes are scoped to the smallest change that closes the exposure — no module rewrites you didn't ask for.
The most dangerous ones, first.
Heeler pairs each IaC finding with the running world: a permissive security group on an internet-facing production service is Urgent; the same setting in a sandbox can wait. Every SCA, SAST, and IaC finding lands on one of three levels.
Urgent
The resource is internet-exposed on a high-tier service. Fix now.
Plan
Real risk, but not immediate — partial exposure or a lower-tier service. Schedule it.
Defer
Not currently exposed — internal-only, or a non-production environment. Track it.
Blocked at the pull request, before it's applied.
The cheapest place to fix a misconfiguration is the definition, because nothing has been stood up yet. Heeler compares the branch against your default-branch baseline and gates only what the change introduces — as a native status check your branch protection already enforces.
Net-new only
Diff-only by design — the guardrail fires on the misconfiguration the pull request introduces, never on the infrastructure backlog it inherited.
Block, warn, or observe
Run any IaC policy in Block, Warn, or Observe mode — test it silently against real pull requests before you enforce it.
Scope by framework or rule
Block on Terraform where your definitions are mature, warn on Kubernetes while manifests still churn — or gate one specific rule. Same policy, two levels of confidence.
Routed to whoever owns the resource.
An IaC finding is infrastructure work, and it rarely belongs to whoever opened the pull request. Heeler resolves the owning team from your organization model, opens the ticket, tracks it against your SLO, and escalates when the clock runs out — with nobody triaging a queue by hand.
Explore Autonomous Operations →See what your definitions are actually provisioning.
A demo runs Heeler on your repositories. In your first session you'll see every misconfiguration in your infrastructure definitions, the resource each one builds, and which of them are exposed in production right now.
