Code review catches what’s wrong in a diff. Heal catches what breaks when the app runs. Heal learns how to run your application, builds a production-like sandbox with external services stubbed, then hunts for bugs, performance regressions, and runtime vulnerabilities users would hit. It reproduces every defect before reporting it, so you get real bugs to fix, not a backlog of AI-generated suspicions.
Hey Product Hunt!!! I’m Malo, co-founder of heal.dev.
The problem:
👉 Code review and static analysis often miss real runtime bugs and vulnerabilities.
👉 Even with top-performing coding agents, we still ship bugs and vulnerabilities to production. We’ve seen that firsthand by running Heal on a collection of open-source repositories: https://www.heal.dev/#sandboxes.
The solution
👉 Instead of just scanning your code, Heal spins up a production-like sandbox with your external dependencies mocked.
👉 Heal finds bugs, perf issues, and vulnerabilities at runtime. It reproduces each against the sandbox before reporting.
👉 Unlike asking a coding agent to write end-to-end tests, Heal proactively hunts for edge cases and runs exploratory testing, not just the happy path.
The key difference
👉 Review bots find what a developer would change to keep code clean. A lot of findings.
👉 Heal finds a proven user behaviour that causes a bug. Fewer findings, closer to the user.
With Heal, you get high-signal, verified bugs and vulnerabilities users would see, and a completely autonomous system. It's free during the beta, no cc required: www.heal.dev
Debate club 🥊 Ding ding ding!
One question for y'all: what makes it so that you don't auto-merge all PRs? Could Heal be the reason you finally do?
The "what code review misses" angle is honest, nobody reads the fifth PR of the day properly. Does it run on every PR or does that get noisy fast?
We trialed Heal on our codebase and the top findings went clearly beyond what our usual Claude/Codex code reviews catch. We've already tackled a dozen findings, including security and performance issues.
For an early-stage product shipping fast, it's been very valuable both as a pen test and as QA. Expect to spend some time triaging: the long tail is big, but the top of the list is definitely worth it!
Nice timing with PHP vulnerabilities, how would your tool have handled the situation in the actual situation
This found things we didn't expect on our codebase. Still wondering how to have it run fully in an automated loop -> part of our CICD process and weekly quality runs over the weekend, and when something is found a PR gets opened automatically. Great job @therealmalo@pierre_oucif1@alexbeno !
I've tested heal.dev heavily (disclaimer: Malo is a friend!) and other solutions/competitors, and this new version of heal is far far better than the inifinite-and-never-ending-list-of-vibe-coded-in-30-days E2E tools that I've also tested. heal creates a flywheel/loop where you can let Claude/Codex code an app, then give it to heal that finds vulnerabilities/bugs missed by Claude/Codex, then let Claude/Codex repair that, and then verify Claude/Codex work with heal, so for some parts of tools I work on, the result after this automatic loop is excellent and much better than Claude/Codex alone.
Ran Heal against our own app and it found real bugs, each with repro steps and a test to prove it. A stored XSS and a cross-tenant data leak were the big ones. The API meant we could triage all 239 findings in about an hour. Congrats on the launch @therealmalo and @pierre_oucif1 .
How much configuration does it take for Heal to learn how to run an app? For projects with non-trivial local setups (multiple services, env specific config), that first step seems like the real test.
Reproducing every defect before reporting it is the right bar, most review bots drown you in maybes. How do you handle apps where the bug only shows up with real third party responses, like a payment or email provider returning something odd that your stubs don't model?
Been using heal.dev to poke holes into our software and it's been really awesome to get these complete, reproducible, lists of issues that I can then throw tokens at to solve.
I think these kinds of grindy agent loops will make codebases converge towards perfection if you apply it to all sorts of gardening in a codebase, like security, patching, refinement, uniformity in design, test flakes, codebase health, etc.
We tried after many code review tools. it's not juste code review Heal found things we didn't expect, that would have costs us $1000 in pen test!
Reproducing a defect before reporting it sets a useful bar. I would like to see the smallest failing case alongside each finding.
We asked ourselves how Heal compares to AI code reviewers, and whether stacking two or three of them closes the gap. So we built a benchmark to find out. TL;DR:
70% of the defects Heal finds, no code reviewer catches. Heal also only flags defects that are on a real user path
Stacking reviewers doesn’t help much: they overlap heavily on the same classes of bugs and all miss the ones that only show up when the app actually runs.
“Find bugs and vulnerabilities code review misses”
heal.dev launched on Product Hunt on October 22nd, 2026 and earned 134 upvotes and 25 comments, placing #6 on the daily leaderboard. Code review catches what’s wrong in a diff. Heal catches what breaks when the app runs. Heal learns how to run your application, builds a production-like sandbox with external services stubbed, then hunts for bugs, performance regressions, and runtime vulnerabilities users would hit. It reproduces every defect before reporting it, so you get real bugs to fix, not a backlog of AI-generated suspicions.
heal.dev was featured in Developer Tools (521.6k followers), Artificial Intelligence (481.7k followers) and Vibe coding (723 followers) on Product Hunt. Together, these topics include over 221.9k products, making this a competitive space to launch in.
Who hunted heal.dev?
heal.dev was hunted by Ben Lang. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how heal.dev stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Ben Lang
Hey Product Hunt!!! I’m Malo, co-founder of heal.dev.
The problem:
👉 Code review and static analysis often miss real runtime bugs and vulnerabilities.
👉 Even with top-performing coding agents, we still ship bugs and vulnerabilities to production. We’ve seen that firsthand by running Heal on a collection of open-source repositories: https://www.heal.dev/#sandboxes.
The solution
👉 Instead of just scanning your code, Heal spins up a production-like sandbox with your external dependencies mocked.
👉 Heal finds bugs, perf issues, and vulnerabilities at runtime. It reproduces each against the sandbox before reporting.
👉 Unlike asking a coding agent to write end-to-end tests, Heal proactively hunts for edge cases and runs exploratory testing, not just the happy path.
The key difference
👉 Review bots find what a developer would change to keep code clean. A lot of findings.
👉 Heal finds a proven user behaviour that causes a bug. Fewer findings, closer to the user.
With Heal, you get high-signal, verified bugs and vulnerabilities users would see, and a completely autonomous system. It's free during the beta, no cc required: www.heal.dev
Debate club 🥊 Ding ding ding!
One question for y'all: what makes it so that you don't auto-merge all PRs? Could Heal be the reason you finally do?