.svg)
AI writes the vulnerability. Heeler ships the deterministic fix.
Finding the SQL injection is the easy part. Heeler writes the fix, proves it in your build, and opens a merge-ready pull request — a deterministic code change, not an LLM's best guess. The bug your agent wrote, closed before it ships.
A finding is not a fix.
Every SAST tool is good at pointing. Then a human still has to write the fix — while AI generates new vulnerabilities faster than the backlog can drain. Detection was never the bottleneck. Remediation is.
Scanners point, then stop
Traditional SAST hands you a severity, a line number, and a link. The vulnerability is still there — now it's a ticket, not a fix.
Someone still hand-writes the patch
Fixing a taint bug means tracing the flow from source to sink and rewriting it safely. That expertise is scarce — and it doesn't scale to thousands of findings.
AI writes bugs faster than you fix them
Coding agents produce vulnerable patterns — string-built SQL, unescaped output, unsafe file paths — at machine speed. Hand-remediation was already behind. Now it's lapped.
From taint path to merged PR.
Heeler already knows the vulnerability cold — the exact source-to-sink path, the fix strategy, and a before/after, all computed at scan time. Auto-fix turns that into a validated pull request.
The fix is computed, not hallucinated.
Heeler doesn't ask a model to invent a patch. Its analysis matches a proven remediation strategy to the exact dataflow and carries a confidence score, so the agent applies a known-good transform — reproducibly, the same fix every time. That's the difference from AI fixers that guess.
A proven transform for the flaws AI writes most.
Every fixable finding maps to a specific code transform, chosen from the vulnerability class. The same vulnerability class follows the same deterministic remediation strategy, anchored to the proven dataflow. The agent adapts that known transform to the current code rather than inventing the security decision from scratch.
High-confidence classes are fixed automatically. Findings that need an architectural change — an auth redesign, unsafe deserialization — get precise guidance instead of a risky PR. You're never handed a fix Heeler isn't sure of.
DUAL VALIDATION
Every fix is proven twice.
First in an isolated sandbox: the agent applies the change and runs a true build with your project's own toolchain — before a pull request even exists. Then through your own CI on the PR, iterating until the checks pass. Automation never quietly hands you a broken build; when it can't get to green, it tells you exactly why.
The agent applies the code transform in an isolated sandbox and runs a true build with your project's own toolchain — not a surface check. A fix that can't build cleanly never gets presented as ready.
Heeler branches, commits, and opens the pull request — the change, the fix strategy it used, its confidence level, and a link back to the finding. If the sandbox build didn't pass, the PR opens as a draft: flagged, never disguised as ready.
Your pipeline runs on the PR exactly as it would for any engineer. Heeler reacts to check results from your SCM the moment they complete — no polling, no waiting.
A CI-fix agent reads the failing logs, attributes the failure to the change, fixes it, and pushes a follow-up commit to the same PR — re-triggering CI. Earlier attempts feed back in, so it never repeats an approach that already failed.
If the loop can't finish, Heeler comments on the PR explaining exactly what it couldn't resolve — every intermediate commit and CI result left in place, plus a link into Heeler for the full run.
All CI checks pass — the PR is ready for review.
A bounded run of repair commits chasing green — then a person gets the finding with the full trail, not a mystery diff.
The agent judges the failure won't resolve automatically and stops early, rather than burning CI cycles.
Everything gets fixed. The most dangerous first.
Auto-fix runs across the backlog, in the order that reduces risk fastest. Heeler traces each finding's reachability — cross-file, cross-function, from source to sink — then weighs runtime exposure, business tier, and active-exploit intelligence. The most dangerous findings get fixed first; nothing gets written off. Every SAST finding lands on one level: Urgent, Plan, or Defer.
See how Heeler Risk scores SAST findings →One agent. Three ways in.
From a finding, from the pull request that introduced it, or from a standing policy — every fix enters the same governed loop.
Three doors into the same loop — every path is sandbox-validated, driven through your CI, never merged for you, and recorded in Agent Executions. A fix that doesn't build never gets pushed; the agent explains what it tried and routes to a human instead.
DEPLOYED
Merge isn't the finish line. Deployed is.
A merged code fix still isn't proven until it's actually running. Because Heeler correlates your running deployments back to source, it tracks each fix past merge and confirms when the vulnerable path is genuinely gone — everywhere it was running.
Active → Fixed → Deployed
Three states, and only the last one means the risk is retired. Fixed means the change merged. Deployed means Heeler has seen the corrected code actually running.
Confirmed, not assumed
The same deployment correlation that decides whether a finding was exploitable in the first place also confirms its closure. No runtime agent, no tagging, no manual sign-off.
Tracked per deployment
A service running in several places isn't closed until every one of them carries the fix. The Lifecycle panel shows the share actually deployed, not an average.
The step most tools skip
Almost every scanner closes a finding the moment the pull request merges. That's an assumption about production. Heeler waits for the evidence instead.
AGENT EXECUTIONS
You can check the agent's work.
Code fixes are recorded alongside dependency fixes — the finding each run addressed, the files it changed, every CI iteration it ran, and where the pull request now stands. A fix the agent couldn't validate opens as a draft, so a change that didn't reach green never looks ready to merge.
See the full audit trail →Heeler fixes the code you import, too.
You've just seen how Heeler fixes the code your team and your agents write. Its other half — SCA Auto-fix — fixes the code you import: it computes, from your dependency graph and live CVE data, the lowest-impact version upgrade that clears the CVEs and adds none, then validates it and opens the same merge-ready PR. One context engine, one prioritization model, one workflow — across both halves of your codebase.
Explore SCA Auto-fix →See Heeler fix your code.
Connect a repo and watch Heeler turn its own SAST findings into validated, merge-ready pull requests — on your code, in your first session.
