.svg)
Three modes. One guardrail framework.
Heeler runs Block, Warn, and Observe guardrails on every pull request. Try new policies in Observe before enforcing them, route warnings to the right reviewers, and block the violations that should never merge — all from one config.
Three enforcement modes, one config.
Each guardrail picks a mode. Mix and match across your policy library — strict where it matters, observational where you're still learning the signal.
Stop the merge.
The PR cannot merge while the violation exists. Use Block for the things that should never land — known-malicious dependencies, critical CVEs in reachable code paths, valid secrets in committed files.
- Hard merge block via required check
- Bypass requires explicit approver + audit trail
- Reasons and remediation steps surfaced in the PR comment
Flag for the reviewer.
The PR can merge, but the warning shows up in the PR with full context. Use Warn for risk that needs a human judgment call — medium-severity issues, deprecated APIs, dependency upgrades that pass tests but change behavior.
- Inline PR comment with the violation explained
- Routed to the right reviewer based on ownership
- Tracked so warnings don't quietly accumulate
Capture the signal silently.
No PR comment, no merge effect — just data. Use Observe to test a new guardrail against your real PR traffic before you roll it out. See what it would have blocked or warned on, tune thresholds, then promote.
- Zero developer-facing noise during testing
- Dashboard shows what would have triggered
- Promote to Warn or Block with one config change
Roll out new policies without breaking PR flow.
The Observe → Warn → Block lifecycle lets you test, tune, and enforce — in that order — instead of guessing where the right threshold is and watching developers route around it.
STEP 01
Observe
Deploy the guardrail in silent mode. Watch what it would have caught against real PRs over a week or two.
STEP 02
Warn
Promote to Warn. Developers see the flag in their PRs; you learn how the signal lands in practice.
STEP 03
Block
Once the signal is clean and false positives are tuned out, promote to Block. The guardrail now prevents merges.
What you can guard on.
Heeler's guardrails draw from the same context engine the audit and remediation layers use. They're org-aware, not just rule-based.
Open-source dependencies
CVEs with reachability and exploitability context, malicious packages, license violations, compromised maintainers — evaluated against your runtime exposure, not just the manifest.
Code patterns
SAST findings with reachability analysis. AI-generated code that introduces auth bypasses, IAM regressions, or secrets handling antipatterns gets caught at PR time.
Secrets
Real, validated secrets in committed files — not placeholder regex hits. Heeler tells you whether the credential is actually live, not just whether it looks like one.
Agent Skills artifacts
PRs that introduce MCP configs, CLAUDE.md updates, or fetched documentation get scanned for prompt injection and suspicious instructions before they merge.
See your real PRs run through Heeler.
A demo on your codebase shows which guardrails would have caught what — and where Observe vs. Warn vs. Block lands for your team.
