.svg)
Find the secret. Prove it's live.
AI coding agents scatter credentials into config, tests, and scripts — and once a secret is committed, it's in your history for good. Heeler catches secrets before they land, then validates each against its real provider, so you rotate the credentials that are actually live instead of chasing dead strings.
Once it's committed, you're not preventing — you're rotating.
AI-assisted development leaks credentials faster than ever — a generated config or test with a live key, committed in seconds. The moment it lands it's in git history, and most scanners bury the one that matters under a pile of dead and inactive strings.
Leaked at machine speed
Agents generate config, tests, and scripts with real credentials — and commit them faster than anyone reviews.
History is forever
A secret committed once lives in git history for good. Catching it after merge means rotation and cleanup, not prevention.
Most alerts are dead
Detection alone floods you with expired, placeholder, and inactive strings. Without knowing which are live, every alert is a fire drill.
Not every secret is a live secret.
Heeler doesn't just find a credential — it validates it against the real provider to see if it still works. So your team rotates the keys that are genuinely exposed, not the expired ones. Hundreds of providers, from clouds and databases to the AI APIs your agents now use.
Tested against the provider
Heeler checks the credential with its own service — is this key still valid? — instead of guessing from the string alone.
Four clear statuses
Active, Inactive, Not attempted, or Unknown. Combined with detection confidence, a live secret from a high-confidence detector is Urgent — everything else sorts to Plan or Defer, so you rotate the real ones first.
Gate on live only
Block and page on validated, active credentials; let dead strings drop to the bottom instead of failing the build.
Hundreds of providers
Cloud, databases, SaaS, and AI APIs — each with the provider-specific detail to act on.
Every secret, wherever it hides.
Language-aware detection tells a live config value from a commented-out example, and entropy and checksums cut the noise before validation even runs. Every finding carries the file, line, commit, and the exact match.
Language-aware
Understands the code around the string — so a real key is flagged and a placeholder in a comment isn't.
Tiered confidence
Provider-specific detectors with checksums score high; generic patterns score low — triage by confidence, not volume.
Full git history
Scans history, not just the current file — catching secrets added and then “deleted,” which still live in the log.
The detail to fix it
File, line, commit, committer, and the exact match — everything needed to find and rotate the credential.
900+ rules, and your own
More than 900 built-in detectors for known credential formats, plus custom YAML rules for the tokens unique to your stack.
Built for large codebases
High-performance, multithreaded scanning sweeps massive repositories — and looks inside compressed archives like tarballs and ZIP-family files — without slowing the pipeline.
From code generation to automated response.
The same detection runs at every stage — catching the secret as early as possible, before it becomes permanent history.
Code generation
It starts before the commit. The skills and instructions steering your AI coding agents are vetted too — so the agent writing your config, tests, and scripts isn't the thing mishandling a credential.
CLI
In the terminal and as a pre-commit hook, the same scan runs on the developer's machine — your source never leaves the box, and the secret is caught before the commit is ever made.
Pull request
By the pull request the secret is already in git history, so the check notifies rather than prevents — it flags the live exposure and starts rotation immediately.
Workflow
A validated, live secret fires a workflow — routed to the owning team via a ticket and a Slack or Teams message, automatically.
Straight to rotation, not a report.
A validated, live secret shouldn't sit in a queue. Heeler blocks it at the PR, routes it to the owner, and opens a rotation ticket with everything they need — provider, location, and validation status.
Guardrails
Block, warn, or notify at the pull request — tuned by confidence and validation status so only real, live secrets stop a merge.
Workflows
A new live secret fires an event — route it to the owning team, message Slack or Teams, and open the ticket automatically.
Rotation-ready tickets
Provider, file and line, and validation status in the ticket — the owner knows exactly what to rotate and where.
See which secrets are actually live.
A demo runs Heeler on your repos. In your first session you'll see the secrets in your history, which ones still work, and exactly where to rotate them.
