Launching today
heal.dev
Find bugs and vulnerabilities code review misses
180 followers
Find bugs and vulnerabilities code review misses
180 followers
Code review catches what’s wrong in a diff. Heal catches what breaks when the app runs. Heal learns how to run your application, builds a production-like sandbox with external services stubbed, then hunts for bugs, performance regressions, and runtime vulnerabilities users would hit. It reproduces every defect before reporting it, so you get real bugs to fix, not a backlog of AI-generated suspicions.
Hey Product Hunt!!! I’m Malo, co-founder of heal.dev.
The problem:
👉 Code review and static analysis often miss real runtime bugs and vulnerabilities.
👉 Even with top-performing coding agents, we still ship bugs and vulnerabilities to production. We’ve seen that firsthand by running Heal on a collection of open-source repositories: https://www.heal.dev/#sandboxes.
The solution
👉 Instead of just scanning your code, Heal spins up a production-like sandbox with your external dependencies mocked.
👉 Heal finds bugs, perf issues, and vulnerabilities at runtime. It reproduces each against the sandbox before reporting.
👉 Unlike asking a coding agent to write end-to-end tests, Heal proactively hunts for edge cases and runs exploratory testing, not just the happy path.
The key difference
👉 Review bots find what a developer would change to keep code clean. A lot of findings.
👉 Heal finds a proven user behaviour that causes a bug. Fewer findings, closer to the user.
With Heal, you get high-signal, verified bugs and vulnerabilities users would see, and a completely autonomous system. It's free during the beta, no cc required: www.heal.dev
Debate club 🥊 Ding ding ding!
One question for y'all: what makes it so that you don't auto-merge all PRs? Could Heal be the reason you finally do?
@therealmalo 💪🏻
This found things we didn't expect on our codebase. Still wondering how to have it run fully in an automated loop -> part of our CICD process and weekly quality runs over the weekend, and when something is found a PR gets opened automatically. Great job @therealmalo @pierre_oucif1 @alexbeno !
Thanks @amaury_soviche1 ! Working on it :)
What you can do is let your coding agent query Heal via MCP, and let it handle the defects founds, then re-run to validate.
We're working on speed and UX on how this can fit neatly in a meta-harness.
We asked ourselves how Heal compares to AI code reviewers, and whether stacking two or three of them closes the gap. So we built a benchmark to find out.
TL;DR:
70% of the defects Heal finds, no code reviewer catches. Heal also only flags defects that are on a real user path
Stacking reviewers doesn’t help much: they overlap heavily on the same classes of bugs and all miss the ones that only show up when the app actually runs.
Full methodology and the defect list: https://www.heal.dev/benchmark
Ran Heal against our own app and it found real bugs, each with repro steps and a test to prove it. A stored XSS and a cross-tenant data leak were the big ones. The API meant we could triage all 239 findings in about an hour. Congrats on the launch @therealmalo and @pierre_oucif1 .
Thanks @mark_ridgeon1 ! We're very grateful for all your feedback along the way!!
I've tested heal.dev heavily (disclaimer: Malo is a friend!) and other solutions/competitors, and this new version of heal is far far better than the inifinite-and-never-ending-list-of-vibe-coded-in-30-days E2E tools that I've also tested. heal creates a flywheel/loop where you can let Claude/Codex code an app, then give it to heal that finds vulnerabilities/bugs missed by Claude/Codex, then let Claude/Codex repair that, and then verify Claude/Codex work with heal, so for some parts of tools I work on, the result after this automatic loop is excellent and much better than Claude/Codex alone.
Thank you@yvan_derogis and thanks for the harsh feedback when we needed harsh feedback!
Been using heal.dev to poke holes into our software and it's been really awesome to get these complete, reproducible, lists of issues that I can then throw tokens at to solve.
I think these kinds of grindy agent loops will make codebases converge towards perfection if you apply it to all sorts of gardening in a codebase, like security, patching, refinement, uniformity in design, test flakes, codebase health, etc.
Thanks @florian_bienefelt !
We tried after many code review tools. it's not juste code review Heal found things we didn't expect, that would have costs us $1000 in pen test!
Thanks @raphael_moutard1 !