> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/fix.md).

# Fix

How Heeler generates a dependency or code fix, validates it in your CI, and opens it as a pull request.

For an open finding, Heeler's remediation agent generates the change, builds and tests it, and opens a pull request. The change is deterministic: the same finding and repository state produce the same fix.

What the agent knows about each repository as it works — a lockfile policy, a required build step, the suite that has to pass — comes from the [memories](/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/remediation-agent.md#memories) you curate.

## The fix lifecycle

Every fix moves through the same path, whichever domain it comes from:

{% stepper %}
{% step %}

### Prioritize

Work the backlog in the right order using Heeler Risk, so the most dangerous, most exploitable issues get handled first.
{% endstep %}

{% step %}

### Auto-fix by domain

Heeler generates the change for the finding — a dependency upgrade for SCA, a before/after code change for SAST, or a fix applied on the PR's own branch for a guardrail.
{% endstep %}

{% step %}

### Validate

The fix is run through your own CI pipeline and iterated until the checks pass, so what reaches you is merge-ready.
{% endstep %}

{% step %}

### Automate at scale

A workflow matches new fixable findings and triggers the agent on them without an operator.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
Auto-fix supports **Java, Go, JavaScript, Python, C#, and Ruby**. Triggering a fix from within Heeler — **Fix Now**, a bulk fix, or a remediation workflow — requires the **Team contributor**, **Organization contributor**, or **Administrator** role. [Guardrail Auto-Fix](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-auto-fix.md) is different: a developer triggers it on their own pull request, so it follows their source-control permissions, not a Heeler role.
{% endhint %}

{% hint style="info" %}
Once the pull request is open you can **ask for a change in a comment** on it, and Heeler **closes the pull request itself** if the finding is resolved some other way. Both are covered on [Validate and Merge-Ready](/mrecEO40m5D6bt7Pq5pE/fix/validate-and-merge-ready.md).
{% endhint %}

## In this section

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Prioritize (Heeler Risk)</strong></td><td>Sequence the backlog with Heeler Risk so risk comes down in the right order.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/fix/prioritize-heeler-risk.md">Prioritize (Heeler Risk)</a></td></tr><tr><td><strong>SCA Auto-Fix</strong></td><td>The safest upgrade path for a vulnerable dependency, made and validated for you.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/fix/sca-auto-fix.md">SCA Auto-Fix</a></td></tr><tr><td><strong>SAST Auto-Fix</strong></td><td>A concrete before/after code change for a weakness, with a named strategy and confidence.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/fix/sast-auto-fix.md">SAST Auto-Fix</a></td></tr><tr><td><strong>Guardrail Auto-Fix</strong></td><td>Fix an eligible vulnerability on the pull request itself.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/fix/guardrail-auto-fix.md">Guardrail Auto-Fix</a></td></tr><tr><td><strong>Automate Remediation</strong></td><td>The workflow configuration that fixes eligible findings without an operator.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/fix/automate-remediation.md">Automate Remediation</a></td></tr><tr><td><strong>Validate and Merge-Ready</strong></td><td>The CI Testing Loop that makes every fix merge-ready.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/fix/validate-and-merge-ready.md">Validate and Merge-Ready</a></td></tr></tbody></table>

## Track what the agent did

Every run from any of these pages — a single fix, a bulk fix, a workflow, or a guardrail — is recorded in **Agent Executions**. It's the audit trail of what ran, where each pull request stands, and the full transcript of the agent's work, and it's where you approve fixes waiting on you or re-run one that failed.

{% content-ref url="/pages/zZIuIFfK0mytIvyXqEYY" %}
[Agent Executions](/mrecEO40m5D6bt7Pq5pE/fix/agent-executions.md)
{% endcontent-ref %}

## Worked example

The same steps as part of a full remediation, from finding to deployed fix:

{% content-ref url="/pages/LPozKjcpRP6t4iCqkQvo" %}
[Fix a Vulnerable Dependency and Verify It's Deployed](/mrecEO40m5D6bt7Pq5pE/solutions-and-use-cases/fix-and-verify-in-production.md)
{% endcontent-ref %}

## Related

* [Remediation Agent](/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/remediation-agent.md) — the memories the agent reads, the PR template it follows, and ticket enforcement (**Administration → Program → Agent**).
* [Remediation Workbench](/mrecEO40m5D6bt7Pq5pE/operate/dashboards/remediation-workbench.md) — plan the burn-down at scale: what's auto-fixable and the highest-impact work by hand (a dashboard under **Operate → Dashboards**).
* [Findings](/mrecEO40m5D6bt7Pq5pE/findings.md) — the risk being fixed, and how it's prioritized.
* [Prevent](/mrecEO40m5D6bt7Pq5pE/prevent.md) — stop new risk from re-entering while you burn the backlog down.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/fix.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.