Introducing Heeler SAST: Context-Aware Static Analysis for the AI Era

Today, we’re launching Heeler SAST, static analysis purpose-built for AI-generated code and agent-driven software delivery.

Traditional SAST tools scan code on a schedule and in isolation. They analyze repositories, generate findings (and noise), and stop there. What they typically lack is context:

• Is this code actually deployed?
• Which running services are affected?
• Is the service externally exposed?
• How has this issue evolved over time?
• Was it truly fixed, or just moved?

Without these answers, teams are left prioritizing in the dark. Heeler SAST was built to change that.

Event-Driven, Commit-Traced Scanning

Heeler runs event-driven scans on every commit and pull request.

Instead of treating each scan as an isolated snapshot, Heeler correlates findings across time: anchoring them to commits, code changes, and authorship.

This is powered by a cross-scan matching strategy that recognizes the same issue even when code shifts or mutates slightly. Rather than relying on fragile line-number comparisons, Heeler compares the vulnerable pattern and surrounding context to determine whether a finding:

• Moved because new code was added above it
• Changed slightly during refactoring
• Was actually remediated
• Was reintroduced later

For example, if 500 lines are added to the top of a file containing 20 vulnerabilities, many SAST tools will report 20 “remediated” issues and 20 “new” ones. Heeler recognizes they are the same findings, just shifted.

This becomes essential in the AI era.

As human developers and AI assistants generate more code at higher velocity, security teams need to trace risk back to the exact commit that introduced or modified it. Heeler makes findings versioned, attributable, and resilient to code churn across both human and AI-generated commits.

Findings are no longer static alerts. They are persistent risk records tied to real code history.

Deep Data Flow Analysis

Heeler SAST goes beyond pattern matching. It performs path-aware data flow analysis across your application.

This includes:

• Function-level taint analysis
• Cross-file taint tracking
• Call stack–aware source → sink modeling

We trace how untrusted input propagates through functions, files, and architectural layers to determine whether a source can actually reach a sensitive sink.

Traditional SAST asks:
“Does this code look dangerous?”

Heeler asks:
“Can this input actually reach something dangerous?”

This depth matters even more with AI-generated code. AI often introduces multi-hop flows — input parsed in one file, transformed in another, and executed elsewhere. These flows can span helpers and abstractions that appear harmless in isolation.

Shallow pattern matching misses this. Heeler traces the full path.

Each finding includes:

• The exact vulnerable execution path
• The commits associated with its introduction and evolution
• Evidence showing how data moves through the application
• Fix guidance grounded in the actual flow

This reduces noise and makes remediation faster and more precise.

But understanding exploitability in code is only half the equation.

Runtime & Service Correlation

A vulnerable path in source code does not automatically equal operational risk.

Heeler correlates SAST findings with:

• Runtime services
• Deployment artifacts
• Internet-facing API exposure
• Service ownership and criticality

This allows us to distinguish between:

• A vulnerable flow inside a dormant module
• A reachable data path inside an internet-exposed production API

Both may look identical in static severity.
Only one represents immediate risk.

By combining deep code analysis with live service context, Heeler computes a Heeler Risk Score grounded in real-world conditions.

Prioritization is based on:

• Reachability – Can this path execute?
• Exposure – Is the affected service externally accessible?
• Deployment status – Is this running in production?
• Service criticality – How important is the service to the business?

This shifts prioritization from severity in isolation to risk in context.

As AI accelerates code generation and distributed architectures increase exposure drift, static analysis must understand not just what exists in code, but what matters in production.

Rule Engine & Customization

Heeler SAST ships with a high-signal base ruleset tuned to your environment.

Instead of relying on mass suppression, Heeler reduces noise through environment-aware tuning, incorporating reachability, deployment status, and service context into how findings are surfaced.

For teams that need extended coverage, Heeler supports custom rules written in the Semgrep rule format.

Custom rules automatically benefit from:

• Cross-scan lifecycle tracking
• Commit attribution
• Runtime and service correlation
• Context-aware risk scoring

Detection can be extended without losing operational intelligence.

To support real-world security programs, Heeler provides:

• Risk overrides (false positives, accepted risk, mitigations)
• Persistent finding state across scans
• Filtering at Global, Repository, Module, and Service levels

Overrides are treated as first-class entities and preserved across future scans, even as code shifts and refactors.

Security decisions persist because findings persist.

Operational Workflows

Heeler SAST integrates directly into engineering workflows.

We support:

• Event-driven scanning on every commit and PR
• Automated ticket creation and routing
• Service-level and ownership-based filtering
• Full lifecycle tracking aligned to remediation processes

Because findings are commit-aware and correlated over time, teams gain precise visibility into change-driven risk:

• What was introduced in this PR
• What remains open
• What is currently deployed
• What is externally exposed

This supports both:

Shift-left development workflows – where developers see contextual risk at the moment of change.

Runtime risk governance – where security prioritizes based on what is actively running and reachable.

Security follows code from commit to production.

Why We Built This

Traditional SAST answers:

“Is this code pattern dangerous?”

Heeler SAST answers:

“Is this deployed, reachable, exposed, and how should we prioritize it?”

That distinction is fundamental.

Static analysis becomes dramatically more valuable when it is:

• Version-aware
• Data-flow precise
• Runtime-correlated
• Deployment-aware
• Exposure-aware

And when it treats findings as evolving risk artifacts, not one-time scan results.

Modern development, especially in the AI era,demands this. Code velocity is accelerating. Architectures are distributed. Exposure changes continuously. Static snapshots are no longer sufficient.

Heeler SAST is built for this reality.

It is now available as part of the Heeler platform.

If you’re interested in a deeper technical walkthrough or architecture discussion, we’d be happy to connect.