Find the secret. Prove it's live.

AI coding agents scatter credentials into config, tests, and scripts — and once a secret is committed, it's in your history for good. Heeler catches secrets before they land, then validates each against its real provider, so you rotate the credentials that are actually live instead of chasing dead strings.

Once it's committed, you're not preventing — you're rotating.

AI-assisted development leaks credentials faster than ever — a generated config or test with a live key, committed in seconds. The moment it lands it's in git history, and most scanners bury the one that matters under a pile of dead and inactive strings.

Leaked at machine speed

• Agents generate config, tests, and scripts with real credentials — and commit them faster than anyone reviews.

History is forever

• A secret committed once lives in git history for good. Catching it after merge means rotation and cleanup, not prevention.

Most alerts are dead

• Detection alone floods you with expired, placeholder, and inactive strings. Without knowing which are live, every alert is a fire drill.

Active Validation

Not every secret is a live secret.

Heeler doesn't just find a credential — it validates it against the real provider to see if it still works. So your team rotates the keys that are genuinely exposed, not the expired ones. Hundreds of providers, from clouds and databases to the AI APIs your agents now use.

Tested against the provider

• Heeler checks the credential with its own service — is this key still valid? — instead of guessing from the string alone.

Four clear statuses

• Active, Inactive, Not attempted, or Unknown. Combined with detection confidence, a live secret from a high-confidence detector is Urgent — everything else sorts to Plan or Defer, so you rotate the real ones first.

Gate on live only

• Block and page on validated, active credentials; let dead strings drop to the bottom instead of failing the build.

Hundreds of providers

• Cloud, databases, SaaS, and AI APIs — each with the provider-specific detail to act on.

Detection

Every secret, wherever it hides.

Language-aware detection tells a live config value from a commented-out example, and entropy and checksums cut the noise before validation even runs. Every finding carries the file, line, commit, and the exact match.

Language-aware

• Understands the code around the string — so a real key is flagged and a placeholder in a comment isn't.

Tiered confidence

• Provider-specific detectors with checksums score high; generic patterns score low — triage by confidence, not volume.

Full git history

• Scans history, not just the current file — catching secrets added and then “deleted,” which still live in the log.

The detail to fix it

• File, line, commit, committer, and the exact match — everything needed to find and rotate the credential.

900+ rules, and your own

• More than 900 built-in detectors for known credential formats, plus custom YAML rules for the tokens unique to your stack.

Built for large codebases

• High-performance, multithreaded scanning sweeps massive repositories — and looks inside compressed archives like tarballs and ZIP-family files — without slowing the pipeline.

EVERYWHERE YOU WORK

From code generation to automated response.

The same detection runs at every stage — catching the secret as early as possible, before it becomes permanent history.

Code generation

• It starts before the commit. The skills and instructions steering your AI coding agents are vetted too — so the agent writing your config, tests, and scripts isn't the thing mishandling a credential.

CLI

• In the terminal and as a pre-commit hook, the same scan runs on the developer's machine — your source never leaves the box, and the secret is caught before the commit is ever made.

Pull request

• By the pull request the secret is already in git history, so the check notifies rather than prevents — it flags the live exposure and starts rotation immediately.

Workflow

• A validated, live secret fires a workflow — routed to the owning team via a ticket and a Slack or Teams message, automatically.

RESPONSE

Straight to rotation, not a report.

A validated, live secret shouldn't sit in a queue. Heeler blocks it at the PR, routes it to the owner, and opens a rotation ticket with everything they need — provider, location, and validation status.

Guardrails

• Block, warn, or notify at the pull request — tuned by confidence and validation status so only real, live secrets stop a merge.

Workflows

• A new live secret fires an event — route it to the owning team, message Slack or Teams, and open the ticket automatically.

Rotation-ready tickets

• Provider, file and line, and validation status in the ticket — the owner knows exactly what to rotate and where.

See which secrets are actually live.

A demo runs Heeler on your repos. In your first session you'll see the secrets in your history, which ones still work, and exactly where to rotate them.