.svg)
Dependency risk, fixed at machine speed.
AI agents pull in dependencies faster than any team can review — and the supply chain is weaponized in minutes, not weeks. Heeler keeps pace: it finds the vulnerable and malicious packages that are actually reachable and running, and ships a deterministic, validated fix. Direct, transitive, first-party, and bundled.
You can't out-triage machine-speed code.
Agents add dependencies — direct, transitive, and from GitHub Actions — faster than anyone can review them, while attackers weaponize new CVEs and compromised packages in minutes. Legacy SCA answers with a CVSS-ranked backlog and “upgrade to latest” tickets. That's human-speed security in a machine-speed world.
The backlog only grows
AI generates dependencies faster than any human can triage. A severity-ranked queue gets longer every sprint — it never gets to zero.
Exploited in minutes
A new CVE or compromised package is weaponized in minutes now. A finding that waits for the next sprint is already too late.
Hidden in the graph
The dangerous package is usually transitive, or pulled in by a GitHub Action — exactly where AI-assisted development moves fastest and review never looks.
The fix, computed and validated.
No “upgrade to latest” ticket. Heeler computes the lowest version that clears the CVEs without adding new ones, opens the PR, builds it, and proves it green — every fix graded Easy, Medium, or Hard up front.
The lowest version that clears the CVEs and adds none — highest security impact, least change. For transitive vulns, the smallest first-party ancestor bump that resolves the whole closure.
The agent applies it, then compiles and builds — Go, Java, and more — looping on CI up to five times to get green, or abstaining to a human.
A PR with the impact, the diff, and proof it builds. Human review by default; no auto-merge.
The analysis engine behind deterministic fixes.
Heeler built its own dependency analysis — tracing reachability, runtime, and business context. That depth is what makes the fixes deterministic, the guardrails precise, and the findings free of false positives — and points your team at the exploitable ones worth fixing first.
Function reachability
Heeler traces the call path from your code to the exact vulnerable function. If nothing you call reaches it, the finding drops — no path, no priority.
Runtime reachability
At runtime, Heeler confirms the vulnerable library is actually loaded and reachable in the running service — not just sitting in a manifest.
Runtime context
Is the service internet-accessible? What does it chain to — other services, and the data and resources behind them? Exposure comes from the live deployment graph.
Business context
Service tier, application criticality, and environmental boundary — production vs. non-prod — decide how much a finding actually matters.
Framework mitigations
Known neutralizations — disabled JNDI lookups, read-only Tomcat, no Spring Actuator, Next.js App Router — suppress CVEs that can't fire in your configuration.
Exploit intelligence
Confirmed real-world exploitation and probability signals set the threat axis — not a static CVSS number.
Every dependency, resolved to an SBOM.
Heeler resolves each code root the way your build does — through a controlled dependency proxy — into a full CycloneDX SBOM. Direct, transitive, first-party, and bundled, every package classified and traced through the graph.
Resolved like your build
Per-ecosystem resolvers run the real toolchain — not a lockfile guess — for an accurate, deduplicated bill of materials, cached across commits.
Direct, transitive, first-party, bundled
Every package is classified and traced through the dependency graph, so one fix on a direct dependency can clear many transitive findings.
Down to GitHub Actions
Actions are resolved to a pinned commit SHA and their own transitive dependencies pulled in — a supply-chain path most scanners never open.
14 package ecosystems
Full-fidelity resolution, advisories, and fixes — not a shallow manifest parse.
The attacks that don't show up as CVEs.
Vulnerable versions are only half the risk. Heeler watches the supply-chain vectors AI-assisted development opens up — malicious packages, unvetted releases, and unpinned dependencies — each enforceable as a guardrail.
Malicious & compromised packages
Cross-referenced against the OpenSSF malicious-packages feed and flagged to block on sight.
Typosquats
Names one edit away from a popular package are caught before they're installed.
Minimum package age
Brand-new releases can be held for a cooldown window — the prime window for a compromised publish to slip in.
Unpinned dependencies
Floating versions and GitHub Actions pinned to a tag instead of a SHA are flagged — a moving target is an attack surface.
Dependency hygiene
OpenSSF Scorecard and a trust score surface unmaintained, deprecated, and low-hygiene packages before they bite.
GitHub Actions supply chain
Actions run on your build systems with high privilege. Heeler resolves each to a SHA and scans its full transitive dependency set.
Blocked at the PR. Routed to the owner.
Finding the risk is step one. Heeler prevents new bad dependencies from ever merging, orchestrates the response to the ones already there, and keeps re-assessing as the threat landscape shifts — all off the same model.
Blocked before merge
PR guardrails stop new vulnerable, malicious, unpinned, or policy-violating dependencies — in Block, Warn, or Observe mode, on your SCM's native checks.
Routed to the owner
Event-driven workflows open the ticket, message Slack or Teams, and route each finding to the team that owns it — automatically, the moment it lands.
Never stale
Heeler re-assesses as new advisories and supply-chain attacks emerge — you learn you're exposed without waiting for the next scan.
See your real dependency risk.
A demo connects Heeler to your repos and cloud. In your first session you'll see which vulnerabilities are actually reachable and running — and the validated fixes, ready to merge.
