.svg)
Fix what can hurt you first.
Autotriage sets Heeler Risk on each dependency and code finding: Urgent, Plan or Defer. It asks how critical the service is, whether an attacker can reach the flaw, and whether it is under attack. Teams get a short list to fix now.
Your teams fix the short list first.
Most findings are not exploitable today. Heeler Risk separates the few that are, and each level carries its own deadline.
Fix now.
Reachable from the internet, on a service that matters, with a threat signal.
Schedule it.
Real risk, but not urgent yet.
Track it.
Not exploitable today. Watched, and raised if that changes.
Your context sets the priority. Not an LLM's opinion.
An LLM asked what matters gives a different answer each run and cannot show its work. Autotriage applies fixed rules to what the Context Engine knows about your environment, so the same inputs always give the same level.
Six finding types, six rules. Choose one:
Three answers pick one cell: how critical the service is, whether an attacker can reach it, and whether it is under attack.
The traced path decides. A flaw on an open internet route outranks the same flaw behind auth on an internal service.
The misconfiguration is matched to the live cloud resource it builds, and ranked on what Heeler sees there.
An image is ranked by the workloads that run it: their tier, their environment, and whether they are internet accessible.
Heeler scans git and its full history, every branch and every commit. It discards fakes with an offline checksum check, then proves what is left with a safe, read-only live test. Each secret lands in an action bucket by what that test found.
Each agent file, skill and MCP config gets a 0 to 100 safety score from fixed arithmetic on what Heeler finds in it.
Priorities follow your environment as it changes.
Flip what is true about one real CVE and watch the level move. Heeler does this on its own whenever your environment changes. No re-triage meeting.
Exploitable, and exploitation is confirmed.
Try it: turn off Internet accessible, or add a mitigation.
You decide what happens after triage. Heeler does it.
Workflows turn each level into an action on every new finding, routed to the owning team.
Every level comes with a deadline.
You set the deadlines: base them on Heeler Risk or on severity, and choose the days for each level, separately for dependencies and code. Heeler then tracks every finding against them, and acts on them for you.
Default windows. Change any of them.
Deadlines follow real-world risk: exposure, reachability, business impact and threat.
CVSS for dependencies, rule severity for code. For programs whose framework ties deadlines to severity, like SOC 2, ISO 27001, FedRAMP or PCI DSS.
Your team's judgment, on the record.
Sometimes the right call is not the default: a false positive, a control Heeler cannot see, no fix available yet, or a risk the business accepts. Record it as an override, with a reason.
More time, same risk.
For no fix available, a complex fix, or other priorities. The due date moves. The level stays, and the original due date stays on record.
A different level, with a reason.
For not reachable, a false positive, an environment configuration or an accepted risk. The finding drops to Defer. Set an expiry and the original level returns when it passes.
Who, when and why.
Live exceptions are listed with who granted them, the reason and when they lapse. Each change is on the finding's history.
