> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/supported-technologies.md).

# Supported Technologies

The languages, ecosystems, source-control systems, clouds, registries, and integrations Heeler supports — the fast answer to "does it cover my stack?"

The quick answer to *"does Heeler cover my stack?"* Everything below is supported today. Coverage differs by capability, so the language tables break it out.

| Languages | Package ecosystems | Source control | Clouds | Registries |   Identity  |
| :-------: | :----------------: | :------------: | :----: | :--------: | :---------: |
|    20+    |         14         |        4       |    3   |     10     | SAML + SCIM |

## Languages

Coverage is broken out by capability: open-source dependencies (**SCA**), static code security (**SAST**), and **secrets**.

| Language              | SCA | SAST | Secrets |
| --------------------- | :-: | :--: | :-----: |
| Java                  |  ✅  |   ✅  |    ✅    |
| Python                |  ✅  |   ✅  |    ✅    |
| Go                    |  ✅  |   ✅  |    ✅    |
| JavaScript            |  ✅  |   ✅  |    ✅    |
| TypeScript            |  ✅  |   ✅  |    ✅    |
| C#                    |  ✅  |   ✅  |    ✅    |
| Ruby                  |  ✅  |   ✅  |    ✅    |
| Rust                  |  ✅  |   ✅  |    ✅    |
| PHP                   |  ✅  |   ✅  |    ✅    |
| Kotlin                |  ✅  |   ✅  |    ✅    |
| Elixir                |  ✅  |   ✅  |    ✅    |
| Swift                 |  ✅  |   ✅  |    ✅    |
| GitHub Actions (YAML) |  ✅  |   ✅  |    ✅    |
| C++                   |  —  |   ✅  |    ✅    |
| Scala                 |  —  |   ✅  |    ✅    |
| Dart                  |  —  |   ✅  |    ✅    |
| ISML                  |  —  |   ✅  |    ✅    |
| Dockerfile            |  —  |   ✅  |    ✅    |
| Helm charts           |  —  |   ✅  |    ✅    |
| Starlark              |  —  |   ✅  |    ✅    |

## Package ecosystems (SCA)

Open-source dependency analysis resolves manifests and lockfiles across these ecosystems. See [Open Source (SCA)](/mrecEO40m5D6bt7Pq5pE/findings/open-source-sca.md) for how findings are analyzed and prioritized.

| Ecosystem             | Language(s)                   | Registry                       |
| --------------------- | ----------------------------- | ------------------------------ |
| Maven                 | Java, Kotlin                  | Maven Central                  |
| sbt                   | Scala                         | Maven Central                  |
| PyPI                  | Python                        | PyPI                           |
| npm                   | JavaScript, TypeScript        | npm registry                   |
| JSR                   | JavaScript, TypeScript (Deno) | jsr.io                         |
| Go modules            | Go                            | Go module proxy                |
| NuGet                 | C# / .NET                     | NuGet Gallery                  |
| RubyGems              | Ruby                          | RubyGems.org                   |
| Composer              | PHP                           | Packagist, packages.drupal.org |
| Composer (wpackagist) | WordPress plugins & themes    | wordpress.org                  |
| Cargo                 | Rust                          | crates.io                      |
| Hex                   | Elixir                        | Hex.pm                         |
| Swift Package Manager | Swift                         | Swift Package Index            |
| CocoaPods             | Swift, Objective-C            | CocoaPods                      |
| Unity UPM             | Unity (C#)                    | Unity Package Registry         |
| GitHub Actions        | Workflow YAML                 | GitHub                         |

**Drupal.** `drupal/*` packages resolve against Drupal's own Composer repository (`packages.drupal.org`) as well as Packagist, so contrib modules published only there are matched against their advisories instead of failing to resolve.

**Legacy NuGet.** Alongside SDK-style projects, `packages.config` projects and non-SDK `.csproj` projects are harvested, so a .NET solution on the older project formats reports its dependencies rather than reporting none.

**WordPress.** Composer-managed WordPress projects — Bedrock-style roots that install plugins and themes as `wpackagist-plugin/*` and `wpackagist-theme/*` — are matched against WordPress plugin, theme, and core advisories. A plugin that was closed upstream over an unfixed security issue reports as having no fix available rather than dropping out of the inventory.

## Dependency cooldown (minimum release age)

Separately from analysis, Heeler reads each project's **minimum-release-age** setting — the [cooldown guardrail](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails/guardrail-types/dependency-sca-guardrails.md) that refuses brand-new package versions until they've aged. The managers below are the ones Heeler detects a cooldown setting for; this is *not* the full list of ecosystems Heeler analyzes (that's the table above).

| Package manager | Config file                  | Setting                |
| --------------- | ---------------------------- | ---------------------- |
| npm             | `.npmrc`                     | min-release-age        |
| pnpm            | `.npmrc`                     | minimum-release-age    |
| Yarn            | `.yarnrc.yml`                | `npmMinimalAgeGate`    |
| Bun             | `bunfig.toml`                | `minimumReleaseAge`    |
| uv              | `pyproject.toml` / `uv.toml` | `exclude-newer`        |
| pip             | `pip.conf`                   | `uploaded-prior-to`    |
| Deno            | `deno.json` / `deno.jsonc`   | `minimumDependencyAge` |

For how to configure each manager (and the CI, laptop, and version-pinning caveats), see [Package-Manager Cooldown](/mrecEO40m5D6bt7Pq5pE/prevent/package-manager-cooldown.md).

## API and endpoints

Endpoint discovery is framework-aware across **13 languages** — Go, Python, Java, Kotlin, TypeScript, JavaScript, PHP, Ruby, C#, Rust, Swift, Scala, and Starlark — with parsing for **20+ web frameworks**. See [Endpoints](/mrecEO40m5D6bt7Pq5pE/catalog/endpoints.md) for how discovered endpoints are modeled and assessed.

| Language                | Frameworks                                                             |
| ----------------------- | ---------------------------------------------------------------------- |
| Python                  | Django, Flask, FastAPI, Starlette, FastMCP                             |
| JavaScript / TypeScript | Express, Fastify, Koa, NestJS, Next.js, Hono, React Router, Vue Router |
| Java / Kotlin           | Spring Boot / Spring MVC, JAX-RS                                       |
| Go                      | Gin, Chi, Echo, Fiber, net/http                                        |
| C#                      | ASP.NET (WebAPI, ASMX)                                                 |
| Ruby                    | Rails                                                                  |
| PHP                     | Laravel                                                                |

## Infrastructure as Code (IaC)

Heeler analyzes the infrastructure definitions in your repositories and reports misconfigurations against the resource each definition builds. See [Infrastructure as Code (IaC)](/mrecEO40m5D6bt7Pq5pE/findings/iac.md).

| Framework      | What's analyzed                                      |
| -------------- | ---------------------------------------------------- |
| Terraform      | `.tf` configuration and the resources it declares    |
| OpenTofu       | The Terraform-compatible fork, analyzed the same way |
| CloudFormation | AWS stack templates                                  |
| Pulumi         | Infrastructure defined in a general-purpose language |
| Kubernetes     | Workload, service, and RBAC manifests                |

## Data entities

Heeler extracts the data entities your code persists or publishes, so it can report on the personal and sensitive data you hold. See [Data Inventory](/mrecEO40m5D6bt7Pq5pE/catalog/data-inventory.md) for how entities are classified.

| Source                  | What's recognized                           |
| ----------------------- | ------------------------------------------- |
| Python                  | SQLAlchemy, Django models                   |
| TypeScript / JavaScript | TypeORM, Prisma, Sequelize                  |
| Java                    | JPA (`@Entity`)                             |
| Go                      | GORM                                        |
| C#                      | Entity Framework Core                       |
| Rust                    | Diesel, SeaORM, SQLx                        |
| Interface schemas       | OpenAPI, GraphQL SDL, protobuf, JSON Schema |

## AI supply chain (agent files)

Heeler assesses the AI agent instruction and configuration files landing in your repositories and scores each for risk. See [AI Supply Chain (Agent Files)](/mrecEO40m5D6bt7Pq5pE/findings/agentic-supply-chain-agent-files.md).

| File type    | What it is                                                                |
| ------------ | ------------------------------------------------------------------------- |
| Instructions | Agent instruction files, such as `CLAUDE.md`, `AGENTS.md`, or `GEMINI.md` |
| Skills       | Reusable agent skill definitions                                          |
| Subagents    | Subagent definitions                                                      |
| Hook scripts | Lifecycle hook scripts                                                    |
| Config       | Agent configuration files                                                 |

## CI systems

Heeler records which CI systems each repository builds on, from the repository's own configuration, and analyzes the pipeline definitions it finds. The detected system is a filter in the [repository catalog](/mrecEO40m5D6bt7Pq5pE/catalog/repositories.md).

| CI system      | What Heeler does with it                                                                                                                                                                                                                    |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| GitHub Actions | Workflows are analyzed for supply-chain and configuration risk — compromised or unpinned actions, dangerous triggers, secret exposure. See [GitHub Actions supply chain](/mrecEO40m5D6bt7Pq5pE/findings/open-source-sca/github-actions.md). |
| Jenkins        | Pipeline definitions and the shared libraries they load are evaluated against a dedicated rule pack for risky configuration.                                                                                                                |

## Source control

Heeler connects to these SCMs for repository analysis, secret scanning, and PR guardrails. [Connect one under Get Started](/mrecEO40m5D6bt7Pq5pE/get-started/source-code-scm.md).

| Provider     | Editions                         |
| ------------ | -------------------------------- |
| GitHub       | Cloud, GitHub Enterprise Server  |
| GitLab       | Cloud, self-managed / on-premise |
| Azure DevOps | Cloud                            |
| Bitbucket    | Cloud, Bitbucket Data Center     |

## Cloud providers

For runtime and deployment context — the code-to-cloud model. [Connect a cloud](/mrecEO40m5D6bt7Pq5pE/get-started/cloud-and-runtime.md).

| Cloud provider              |
| --------------------------- |
| Amazon Web Services (AWS)   |
| Google Cloud Platform (GCP) |
| Microsoft Azure             |

## Hosting platforms

Managed hosting platforms that publish their own deployment metadata, so Heeler reads what's live — and the commit behind it — directly from the platform. [Connect one under Get Started](/mrecEO40m5D6bt7Pq5pE/get-started/cloud-and-runtime/vercel.md).

| Hosting platform |
| ---------------- |
| Vercel           |

## Container and artifact registries

[Connect a registry](/mrecEO40m5D6bt7Pq5pE/get-started/registries-and-artifacts.md) to tie built artifacts back to source.

| Registry                  | Vendor             |
| ------------------------- | ------------------ |
| GitHub Container Registry | GitHub             |
| GitHub Package Registry   | GitHub             |
| GitLab Package Registry   | GitLab             |
| Amazon ECR                | AWS                |
| AWS CodeArtifact          | AWS                |
| GCP Artifact Registry     | Google Cloud       |
| JFrog Artifactory         | JFrog              |
| Harbor                    | CNCF / self-hosted |
| Sonatype Nexus            | Sonatype           |
| Docker Hub                | Docker             |

## Container image scanning

[Container image scanning](/mrecEO40m5D6bt7Pq5pE/findings/containers.md) covers images pushed to these registries. It needs cloud event collection on the account that owns the registry.

| Registry                          | Vendor       |
| --------------------------------- | ------------ |
| Amazon ECR (private repositories) | AWS          |
| Google Artifact Registry          | Google Cloud |

Operating-system packages and support dates are reported for these distributions:

| Distribution family          |
| ---------------------------- |
| Alpine Linux                 |
| Debian                       |
| Ubuntu                       |
| Amazon Linux                 |
| Red Hat Enterprise Linux     |
| CentOS                       |
| CentOS Stream                |
| Rocky Linux                  |
| AlmaLinux                    |
| Oracle Linux                 |
| Fedora                       |
| Photon OS                    |
| SUSE Linux Enterprise Server |
| openSUSE Leap                |
| Wolfi                        |
| Chainguard                   |
| Echo                         |

Language runtimes inside an image are reported with their support state for .NET, Go, Java, Node.js, PHP, Python and Ruby.

## Ticketing

Open and sync work items in your issue tracker. [Set up under Get Started](/mrecEO40m5D6bt7Pq5pE/get-started/ticketing.md).

| Ticketing integration |
| --------------------- |
| Jira                  |
| Linear                |
| Shortcut              |
| GitHub Issues         |
| Webhooks              |

## Messaging

Route notifications to your team's channels. [Set up under Get Started](/mrecEO40m5D6bt7Pq5pE/get-started/messaging.md).

| Messaging integration |
| --------------------- |
| Slack                 |
| Microsoft Teams       |
| Google Chat           |

## Developer platform

Surface Heeler context in your internal developer platform. [Set up under Get Started](/mrecEO40m5D6bt7Pq5pE/get-started/developer-platform.md).

| Developer platform integration |
| ------------------------------ |
| Port.io                        |
| GitHub                         |
| GitLab                         |

## Single sign-on and provisioning

Heeler supports **SAML 2.0** single sign-on with any compliant identity provider, plus **SCIM 2.0** provisioning for automated user lifecycle management — accounts are created, updated, and deactivated (with sessions and API tokens revoked) automatically as your IdP changes. SCIM runs alongside SAML and works with any SCIM 2.0 provider, such as Okta and Microsoft Entra ID. [Configure both under Users & Access](/mrecEO40m5D6bt7Pq5pE/get-started/users-and-access.md).

| Identity provider (SAML 2.0 SSO) |
| -------------------------------- |
| Okta                             |
| Microsoft Entra ID               |
| Ping Identity                    |
| Auth0                            |
| Google Workspace                 |
| Any SAML 2.0 identity provider   |

## Related

* [Get Started](/mrecEO40m5D6bt7Pq5pE/get-started.md) — connect your stack and read its findings.
* [Overview](/mrecEO40m5D6bt7Pq5pE/overview.md) — what Heeler does with everything it supports.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/supported-technologies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.