Launching today
heal.dev
Find bugs and vulnerabilities code review misses
59 followers
Find bugs and vulnerabilities code review misses
59 followers
Code review catches what’s wrong in a diff. Heal catches what breaks when the app runs. Heal learns how to run your application, builds a production-like sandbox with external services stubbed, then hunts for bugs, performance regressions, and runtime vulnerabilities users would hit. It reproduces every defect before reporting it, so you get real bugs to fix, not a backlog of AI-generated suspicions.
Hey Product Hunt!!! I’m Malo, co-founder of heal.dev.
The problem:
👉 Code review and static analysis often miss real runtime bugs and vulnerabilities.
👉 Even with top-performing coding agents, we still ship bugs and vulnerabilities to production. We’ve seen that firsthand by running Heal on a collection of open-source repositories: https://www.heal.dev/#sandboxes.
The solution
👉 Instead of just scanning your code, Heal spins up a production-like sandbox with your external dependencies mocked.
👉 Heal finds bugs, perf issues, and vulnerabilities at runtime. It reproduces each against the sandbox before reporting.
👉 Unlike asking a coding agent to write end-to-end tests, Heal proactively hunts for edge cases and runs exploratory testing, not just the happy path.
The key difference
👉 Review bots find what a developer would change to keep code clean. A lot of findings.
👉 Heal finds a proven user behaviour that causes a bug. Fewer findings, closer to the user.
With Heal, you get high-signal, verified bugs and vulnerabilities users would see, and a completely autonomous system. It's free during the beta, no cc required: www.heal.dev
Debate club 🥊 Ding ding ding!
One question for y'all: what makes it so that you don't auto-merge all PRs? Could Heal be the reason you finally do?
@therealmalo 💪🏻
We asked ourselves how Heal compares to AI code reviewers, and whether stacking two or three of them closes the gap. So we built a benchmark to find out.
TL;DR:
70% of the defects Heal finds, no code reviewer catches. Heal also only flags defects that are on a real user path
Stacking reviewers doesn’t help much: they overlap heavily on the same classes of bugs and all miss the ones that only show up when the app actually runs.
Full methodology and the defect list: https://www.heal.dev/benchmark
Been using heal.dev to poke holes into our software and it's been really awesome to get these complete, reproducible, lists of issues that I can then throw tokens at to solve.
I think these kinds of grindy agent loops will make codebases converge towards perfection if you apply it to all sorts of gardening in a codebase, like security, patching, refinement, uniformity in design, test flakes, codebase health, etc.
We tried after many code review tools. it's not juste code review Heal found things we didn't expect, that would have costs us $1000 in pen test!
Thanks @raphael_moutard1 !
Reproducing a defect before reporting it sets a useful bar. I would like to see the smallest failing case alongside each finding.
@oleksii_sekundant spot on! What heal does is give a script/test that allows to reproduce the issue and validate it's fixed. Both useful for repro, and having a feedback loop to verify the work of the coding agent you ask for a fix.
Reproducing every defect before reporting it is the right bar, most review bots drown you in maybes. How do you handle apps where the bug only shows up with real third party responses, like a payment or email provider returning something odd that your stubs don't model?
@thamibenjelloun That's a great question. The agent adds the best stubs it can (it can take docs as an input), but if you need to add more knowledge about something that happened and isn't in the mocks, you can tell the agent (eg. with our MCP server) to add it.
We had this use case on a side project with Maptiler and Strava integrations, logged the errors in @BetterStack with their MCP server, and asked the agent to enrich the mocks with them.