Launched this week
heal.dev
Find bugs and vulnerabilities code review misses
828 followers
Find bugs and vulnerabilities code review misses
828 followers
Code review catches what’s wrong in a diff. Heal catches what breaks when the app runs. Heal learns how to run your application, builds a production-like sandbox with external services stubbed, then hunts for bugs, performance regressions, and runtime vulnerabilities users would hit. It reproduces every defect before reporting it, so you get real bugs to fix, not a backlog of AI-generated suspicions.
Free Options
Launch Team / Built With
Render: Get up to $100K in startup creditsThe fastest way to deploy and scale apps and agents
Promoted
Been using heal.dev to poke holes into our software and it's been really awesome to get these complete, reproducible, lists of issues that I can then throw tokens at to solve.
I think these kinds of grindy agent loops will make codebases converge towards perfection if you apply it to all sorts of gardening in a codebase, like security, patching, refinement, uniformity in design, test flakes, codebase health, etc.
Thanks @florian_bienefelt !
We trialed Heal on our codebase and the top findings went clearly beyond what our usual Claude/Codex code reviews catch. We've already tackled a dozen findings, including security and performance issues.
For an early-stage product shipping fast, it's been very valuable both as a pen test and as QA. Expect to spend some time triaging: the long tail is big, but the top of the list is definitely worth it!
Thanks@antoine_bellami ! This is clearly a big area of work for us. The question we're trying to solve now is: how can we make validating less-urgent findings so easy, that you don't really have to think about them.
One of the friction points here is sometimes we discover issues (corner cases not addressed), infer an expected state (it should give an error message), but upon review the user decides that "this is just an area of the product I didn't think properly about". We're working on workflow to help get further along easier.
Sounds very promising, and I´m amazed that it is free - but, I stopped at "Let Heal
read your code" from the site. I know that technically it doesn´t make a difference, but to me it would be more trustworthy if it first installed the app, then, from a local application, it asked for access to the code base (ideally, local). I am very curious to try it out, but wary of just handing out the keys like that to my online codebase. It should be local, in my opinion - no trust needed!
We tried after many code review tools. it's not juste code review Heal found things we didn't expect, that would have costs us $1000 in pen test!
Thanks @raphael_moutard1 !
would it catch missing rate limits on stuff like signup or password reset?
@bbueno Yes! This is typically the type of things that Heal catches.
@therealmalo nice, thanks Malo
We have built something similar in house for our products. It would be interesting to see how heal.dev can help our process.
Hey @new_user___12820256767e8b07ceb063c , for sure! You get a free run of heal when you subscribe, so feel free to give it a go!
We love this product! It found many issues on our repo github.com/twentyhq/twenty
Thanks @_felx , and we're working on getting it more in the dev workflow so it can be seamless! Thanks for all the feedback!!