.svg)
Know which dependency risk is real. Fix it at machine speed.
Heeler resolves your full dependency graph — direct, transitive, first-party, and bundled — then combines function reachability, runtime state, business context, and exploit intelligence to show which vulnerabilities actually matter. Fixable findings flow directly into deterministic remediation instead of ending as another upgrade ticket.
You can't out-triage machine-speed code.
Agents add dependencies — direct, transitive, and from GitHub Actions — faster than anyone can review them, while attackers weaponize new CVEs and compromised packages in minutes. Legacy SCA answers with a CVSS-ranked backlog and “upgrade to latest” tickets. That's human-speed security in a machine-speed world.
The backlog only grows
AI generates dependencies faster than any human can triage. A severity-ranked queue gets longer every sprint — it never gets to zero.
Exploited in minutes
A new CVE or compromised package is weaponized in minutes now. A finding that waits for the next sprint is already too late.
Hidden in the graph
The dangerous package is usually transitive, or pulled in by a GitHub Action — exactly where AI-assisted development moves fastest and review never looks.
The fix, computed and validated.
No “upgrade to latest” ticket. Heeler computes the lowest version that clears the CVEs without adding new ones, opens the PR, builds it, and proves it green — every fix graded Easy, Medium, or Hard up front.
The lowest version that clears the CVEs and adds none — highest security impact, least change. For transitive vulns, the smallest first-party ancestor bump that resolves the whole closure.
The agent applies it, then compiles and builds — Go, Java, and more — looping on CI a bounded number of times to get green, or abstaining to a human.
A PR with the impact, the diff, and proof it builds. Human review by default; no auto-merge.
The analysis engine behind deterministic fixes.
Heeler built its own dependency analysis — tracing reachability, runtime, and business context. That depth is what makes the fixes deterministic, the guardrails precise, and the findings worth acting on — and it sequences the backlog so the most dangerous work happens first.
Function reachability
Heeler traces the call path from your code to the exact vulnerable function. If nothing you call reaches it, the finding drops — no path, no priority.
Runtime reachability
At runtime, Heeler confirms the vulnerable library is actually loaded and reachable in the running service — not just sitting in a manifest.
Runtime context
Is the service internet-accessible? What does it chain to — other services, and the data and resources behind them? Exposure comes from the live deployment graph.
Business context
Service tier, application criticality, and environmental boundary — production vs. non-prod — decide how much a finding actually matters.
Framework mitigations
Known neutralizations — disabled JNDI lookups, read-only Tomcat, no Spring Actuator, Next.js App Router — suppress CVEs that can't fire in your configuration.
Exploit intelligence
Confirmed real-world exploitation and probability signals set the threat axis — not a static CVSS number.
Every dependency, resolved to an SBOM.
Heeler resolves each code root the way your build does — through a controlled dependency proxy — into a full CycloneDX SBOM. Direct, transitive, first-party, and bundled, every package classified and traced through the graph.
Resolved like your build
Per-ecosystem resolvers run the real toolchain — not a lockfile guess — for an accurate, deduplicated bill of materials, cached across commits.
Direct, transitive, first-party, bundled
Every package is classified and traced through the dependency graph, so one fix on a direct dependency can clear many transitive findings.
Down to GitHub Actions
Actions are resolved to a pinned commit SHA and their own transitive dependencies pulled in — a supply-chain path most scanners never open.
Supported ecosystems, resolved with full fidelity
Full-fidelity resolution, advisories, and fixes — not a shallow manifest parse.
The image, not just the manifest
The same inventory covers the container images your workloads run — the operating-system packages and language runtimes inside the layers, which no manifest lists. Exportable in CycloneDX or SPDX.
The attacks that don't show up as CVEs.
Vulnerable versions are only half the risk. Heeler watches the supply-chain vectors AI-assisted development opens up — malicious packages, unvetted releases, and unpinned dependencies — each enforceable as a guardrail.
Malicious & compromised packages
Cross-referenced against the OpenSSF malicious-packages feed and flagged to block on sight.
Typosquats
Names one edit away from a popular package are caught before they're installed.
Minimum package age
Brand-new releases can be held for a cooldown window — the prime window for a compromised publish to slip in.
Unpinned dependencies
Floating versions and GitHub Actions pinned to a tag instead of a SHA are flagged — a moving target is an attack surface.
Dependency hygiene
OpenSSF Scorecard and a trust score surface unmaintained, deprecated, and low-hygiene packages before they bite.
GitHub Actions supply chain
Actions run on your build systems with high privilege. Heeler resolves each to a SHA and scans its full transitive dependency set.
Already in your tree
Compromised packages get their own queue — every place one landed, by repository, module and version, with the advisory behind it. Malicious code isn't something to rank or accept, so there's nothing to triage: only how fast it comes out.
Vulnerable is one question. Allowed to ship is another.
Copyleft and restricted licenses arrive through transitive dependencies nobody reviewed. Heeler checks every dependency against your policy and lists every place a denied license landed — the repository, the module it was declared in, and how it got there.
Judged on the version you pinned
The license on the release you actually depend on — not whatever the package publishes today.
One row per place it landed
A denied package pulled into six modules is six rows — each one a separate thing to fix or approve.
Exceptions that stay settled
Approve a package on a module and every version of it there is covered, so a routine bump doesn't reopen a decision you already made. Each one carries a reason, an owner, and an optional expiry.
Caught before it lands
The same policy runs in the CLI at the keyboard and as a guardrail on the pull request — so a denied license is stopped, not discovered in an audit.
Blocked at the PR. Routed to the owner.
Finding the risk is step one. Heeler prevents new bad dependencies from ever merging, orchestrates the response to the ones already there, and keeps re-assessing as the threat landscape shifts — all off the same model.
Blocked before merge
PR guardrails stop new vulnerable, malicious, unpinned, or policy-violating dependencies — in Block, Warn, or Observe mode, on your SCM's native checks.
Routed to the owner
Event-driven workflows open the ticket, message Slack or Teams, and route each finding to the team that owns it — automatically, the moment it lands.
Never stale
Heeler re-assesses as new advisories and supply-chain attacks emerge — you learn you're exposed without waiting for the next scan.
See your real dependency risk.
A demo connects Heeler to your repos and cloud. In your first session you'll see which vulnerabilities are actually reachable and running — and the validated fixes, ready to merge.
