Compare your project with outside code and check whether it fits your intended use.
See Heimdall’s four-step workflow: scan, understand, fix, and verify.
Watch Heimdall map the repository and report which source file it is inspecting.
View saved scans, open findings, readiness scores, files, and package counts.
Heimdall checks secrets, risky code, packages, websites, connected tools, and scan changes.
Heimdall sends Gemini a structured, redacted report for project-specific security guidance.
See the score, top issue, files checked, packages, and known vulnerabilities.
Review redacted evidence, the affected file, security classification, and recommended fix.
Findings are ranked by severity with plain-language evidence and clear next steps.
Turn the top finding into a checklist, apply the fix, and scan again to verify it.
Heimdall sorts detected problems by severity and presents them in plain language with redacted evidence and a clear next action.

🔱 Heimdall

Inspiration

AI tools like Gemini, ChatGPT, and Claude Code are making it ridiculously easy to build software at breakneck speed. Anyone can go from idea to deployed app in an afternoon. But as building gets easier, a terrifying question gets brushed aside: Is this code actually secure?

Over 1.13 million public GitHub repos now use LLM SDKs (up 178% year-over-year), while over 30% of real-world security breaches start with vulnerability exploitation.

Existing security scanners (SAST/DAST) aren't built for modern builders. They dump a massive list of noisy, jargon-heavy warnings onto your screen and walk away. Developers don't want 200 false positives; they need to know:

What’s actually broken?
Why does it matter to my specific app?
What is the exact code I need to change to fix it?

That’s why we built Heimdall.

What It Does

Heimdall acts as your automated security engineer. Paste a public GitHub repository link, and Heimdall immediately gets to work:

Scans & Maps: Inspects source files, dependencies, and code structure for exposed secrets, risky pattern logic, vulnerable packages, and misconfigured permissions.
Analyzes Agentic Code: For apps building with AI agents, Heimdall maps out the precise relationships between agents, tools, user inputs, and sensitive backend execution paths.
Explains with Evidence: Translates complex findings into plain English, complete with exact file locations and structural context.
Generates Fixes: Delivers project-specific, production-ready remediation code—not generic advice.
Verifies the Patch: Rescans your updated code to prove the issue was actually resolved before you ship.

Scan → Understand → Fix → Verify.

How We Use Google Gemini

Gemini serves as Heimdall’s Remediation & Intelligence Engine.

Static analysis tools excel at spotting structural evidence, but they fail at explaining context or writing custom patches. That’s where Gemini shines:

Context-Aware Remediation: Heimdall extracts raw vulnerability evidence from AST parsing and OSV dependency checks. We hand this structured context to Gemini, which acts as a senior security engineer to write line-by-line, repository-tailored code patches.
Privacy & Trust First: Heimdall redacts all raw secrets, keys, and credentials before sending context to Gemini. Furthermore, Gemini is never used as an unvetted source of truth—Heimdall independently re-evaluates code changes after Gemini generates them to verify the fix.

Heimdall finds the evidence → Gemini crafts the fix → Heimdall proves it works.

How We Built It

Analysis Core: Built with JavaScript / Node.js using the Babel Parser for deep Abstract Syntax Tree (AST) code structure analysis and relationship mapping.
Vulnerability Data: Integrated directly with the OSV (Open Source Vulnerabilities) Database to flag real-time supply chain risks.
AI & Reasoning: Google Gemini API for root-cause translation and production-ready patch generation.
Platform: GitHub REST APIs for repository fetching and GitHub Pages for rapid deployment.

Note: Heimdall analyzes repository code statically as data it never executes untrusted code.

Challenges We Ran Into

Cutting Through Signal vs. Noise: Most static tools flood users with low-severity warnings. We spent considerable time tweaking our AST parsing and OSV matching logic so that Heimdall only escalates findings backed by concrete code evidence.
Redacting Data Safely: Passing codebase context to an LLM safely meant engineering strict sanitization pipelines. We had to ensure secret keys and environmental variables are stripped cleanly without removing the surrounding logic Gemini needs to generate a patch.
Preventing Hallucinated Security: LLMs can sound convincing even when wrong. We solved this by designing a closed-loop workflow: Gemini’s generated fixes must pass a secondary re-scan by Heimdall’s deterministic engine before being marked as "Resolved."

Accomplishments That We're Proud Of

Beyond a Dashboard Mockup: Heimdall does real, live AST parsing, AST relationship mapping for AI agents, real-time dependency checks, and automated verification.
Zero-Jargon Explanations: Created an interface that turns opaque security alerts into clear, actionable advice that even junior developers can immediately understand.
Privacy-Conscious AI: Successfully built a pipeline that leverages Gemini's intelligence without exposing raw user secrets.

What We Learned

Proof Beats Alert Fatigue: Developers care far less about the technical classification name of a CVE and far more about seeing the exact line of code affected and how to patch it.
Deterministic Rules + LLM Reasoning = The Sweet Spot: Using AST parsers for exact evidence gathering and Gemini for context-aware explanations gave us the best of both worlds: factual precision and natural usability.

What's Next

Private Repos & GitHub Actions: Bringing Heimdall directly into PR checks so it automatically comments with ready-to-merge fix PRs.
Deeper Agent & MCP Security: Expanding our analysis on Model Context Protocol (MCP) permissions, prompt injection vectors, and excessive tool access for AI agents.
Continuous Monitoring: Setting up continuous security passports for deployed repositories.