Launched this week
heal.dev
Find bugs and vulnerabilities code review misses
828 followers
Find bugs and vulnerabilities code review misses
828 followers
Code review catches what’s wrong in a diff. Heal catches what breaks when the app runs. Heal learns how to run your application, builds a production-like sandbox with external services stubbed, then hunts for bugs, performance regressions, and runtime vulnerabilities users would hit. It reproduces every defect before reporting it, so you get real bugs to fix, not a backlog of AI-generated suspicions.
Hey Product Hunt!!! I’m Malo, co-founder of heal.dev.
The problem:
👉 Code review and static analysis often miss real runtime bugs and vulnerabilities.
👉 Even with top-performing coding agents, we still ship bugs and vulnerabilities to production. We’ve seen that firsthand by running Heal on a collection of open-source repositories: https://www.heal.dev/#sandboxes.
The solution
👉 Instead of just scanning your code, Heal spins up a production-like sandbox with your external dependencies mocked.
👉 Heal finds bugs, perf issues, and vulnerabilities at runtime. It reproduces each against the sandbox before reporting.
👉 Unlike asking a coding agent to write end-to-end tests, Heal proactively hunts for edge cases and runs exploratory testing, not just the happy path.
The key difference
👉 Review bots find what a developer would change to keep code clean. A lot of findings.
👉 Heal finds a proven user behaviour that causes a bug. Fewer findings, closer to the user.
With Heal, you get high-signal, verified bugs and vulnerabilities users would see, and a completely autonomous system. It's free during the beta, no cc required: www.heal.dev
Debate club 🥊 Ding ding ding!
One question for y'all: what makes it so that you don't auto-merge all PRs? Could Heal be the reason you finally do?
@therealmalo 💪🏻
This found things we didn't expect on our codebase. Still wondering how to have it run fully in an automated loop -> part of our CICD process and weekly quality runs over the weekend, and when something is found a PR gets opened automatically. Great job @therealmalo @pierre_oucif1 @alexbeno !
Thanks @amaury_soviche1 ! Working on it :)
What you can do is let your coding agent query Heal via MCP, and let it handle the defects founds, then re-run to validate.
We're working on speed and UX on how this can fit neatly in a meta-harness.
We asked ourselves how Heal compares to AI code reviewers, and whether stacking two or three of them closes the gap. So we built a benchmark to find out.
TL;DR:
70% of the defects Heal finds, no code reviewer catches. Heal also only flags defects that are on a real user path
Stacking reviewers doesn’t help much: they overlap heavily on the same classes of bugs and all miss the ones that only show up when the app actually runs.
Full methodology and the defect list: https://www.heal.dev/benchmark
@bengeekly That's out of our current scope, but it brings about some ideas for the future. Currently, we hunt for issues in the application code, and we don't run it on libs. Some topic for us to investigate!
@bengeekly the two CVEs are in the php interpreter itself and our agent is focusing on bugs in the codebase, not inside the installed libs, language api, etc. But as these CVEs are related to memory management and so runtime, it's a bit related/adjacent to the runtime bugs we are finding to reproduce user (human and machine) behaviors.
I love the idea! However, my company uses CodeCommit for most of our projects rather than GitHub. Are there any plans in the future to add local Git compatibility?
@tj_ferry hey! We already have a local version of our agent that we are using for R&D. We plan to release it in couple of months ;)
Ran Heal against our own app and it found real bugs, each with repro steps and a test to prove it. A stored XSS and a cross-tenant data leak were the big ones. The API meant we could triage all 239 findings in about an hour. Congrats on the launch @therealmalo and @pierre_oucif1 .
Thanks @mark_ridgeon1 ! We're very grateful for all your feedback along the way!!
I've tested heal.dev heavily (disclaimer: Malo is a friend!) and other solutions/competitors, and this new version of heal is far far better than the inifinite-and-never-ending-list-of-vibe-coded-in-30-days E2E tools that I've also tested. heal creates a flywheel/loop where you can let Claude/Codex code an app, then give it to heal that finds vulnerabilities/bugs missed by Claude/Codex, then let Claude/Codex repair that, and then verify Claude/Codex work with heal, so for some parts of tools I work on, the result after this automatic loop is excellent and much better than Claude/Codex alone.
Thank you@yvan_derogis and thanks for the harsh feedback when we needed harsh feedback!