Heatshield · Codebase scans

Your codebase is full of bugs.

Heatshield sends thousands of AI agents through your codebase to find and fix the bugs that would otherwise burn through to production.

No spam. One email when we're ready for you.

See what the engagement looks like →

app.re-entry.ai / posturelive · 4m ago

NIS2 personal liability exposure

Elevated

2/540%controls in scope covered

2covered2open gaps1unmapped

Controls in scope

v0.1 · NIS2

Art. 21(2)(j)Multi-factor authentication enforcedOpen gap
Art. 2324h incident reporting workflow in placeOpen gap
Art. 21(2)(h)Encrypted secret store in useCovered
Art. 21(2)(i)Quarterly access reviews evidencedCovered

Three workflows. End to end. Live on day one.

Every line below is shipping today — no roadmap items, no "coming soon." Vanta-grade depth, built for NIS2, DORA and the EU AI Act first.

Map

Find serious bugs in your codebase.

Thousands of AI agents read every line of your code every night. They surface critical bugs, hardcoded secrets, and CVEs — and name the developer who introduced them and when.

12 EU integrations · GitHub, GitLab, AWS, Azure / Entra, Okta, Jira, Linear, Sentry, Slack, PagerDuty, Calendar
126 controls modelled across NIS2, DORA, EU AI Act, ISO 27001, GDPR and BSI C5
Read-only OAuth per system · scope-limited · revocable in one click
Nightly snapshot · immutable per-control trail · audit-grade chain of custody

126 controls · 6 frameworks · 12 integrations

Detect

Drops into your workflow.

Heatshield opens fix PRs automatically and routes findings to the developer who introduced them. Issues close when the fix lands. No new dashboard to babysit.

Severity-graded findings · Critical / High / Medium · routed to the article they break
Owner auto-assigned from CODEOWNERS, IdP groups and historical attestations
Pre-filled attestation forms generated from the harvest — your team signs, the gap closes
Cadence tracking · quarterly access reviews · DORA Art. 25 testing · drill schedule

Owner + deadline + form draft per gap

Export

Runs every night. Or before a big release.

Nightly scans catch regressions before they ship. On-demand scans give you a fresh read before a high-stakes change.

BSI-template-aligned PDF · auditor accepts directly · German + English
JSON export for auditor systems · machine-readable per-control state
Versioned snapshots · audit history per quarter, per framework
Per-control evidence trail · every line cites its source system and timestamp

PDF · JSON · per-control trail · versioned

Inside the cohort

Everything that ships in the six-month engagement.

€1,000 / month for six months. No procurement loop. No hidden services line. Eight concrete things you get — measured, dated, refundable if we miss.

First BSI evidence pack in 2 weeks

Or we end the engagement and refund the month. Two-week SLA on the first audit-ready PDF, measured from harvest connection.

12 EU integrations connected on day one

GitHub, GitLab, AWS, Azure / Entra, Okta, Jira, Linear, Sentry, Slack, PagerDuty and Calendar — read-only OAuth, scope-limited, revocable in one click.

126 controls across 6 frameworks

NIS2, DORA, EU AI Act, ISO 27001, GDPR, BSI C5 — every control mapped to live evidence, not a Confluence stub.

Gap detection with owner + attestation draft

Every finding ships with a named owner derived from your IdP, severity grading and a pre-filled attestation form ready to sign.

BSI-aligned PDF + JSON export

Auditor-accepted German + English PDFs, plus a JSON snapshot per quarter for auditor systems. Per-control evidence trail with chain of custody.

Cadence tracking baked in

Quarterly access reviews, DORA Art. 25 resilience testing, drill schedules — surfaced as findings the moment they break, not at year-end.

EU residency without asterisks

Frankfurt-hosted (Hetzner). Processed in the EU. No US sub-processor on the evidence path. No Schrems II exposure. Sub-processor list published per BSI C5 conventions.

Weekly founders call

One of the founders is on every weekly call. If a control doesn't map, we add it together. Design partners shape the product before the wider market sees it.

Built for fast triage and faster fixes.

Everything a developer needs to act on a finding — right in the surface they already work in.

Triage

CISO at an essential or important entity

Every finding ships with evidence, severity, and blast radius. One line is enough to decide whether to act.

Trigger: BSI audit letter, board risk question, customer security questionnaire

Assign

Head of Compliance at a financial entity

Heatshield identifies the developer who introduced the issue from git history and routes the finding directly to them.

Trigger: BaFin information request, ICT register cleanup, Art. 25 testing plan

Fix

Head of AI / DPO at an AI deployer

Apply patches locally through the IDE. Cloud fix agents open PRs for the rest — and verify the fix with a follow-up scan.

Trigger: DPIA scope review, customer AI questionnaire, internal AI governance project

Join the cohort

Run Heatshield against your codebase.

Get on the waitlist. Design-partner slots open weekly.

No spam. One email when we're ready for you.

Your codebase is full of bugs.

Three workflows. End to end. Live on day one.

Find serious bugs in your codebase.

Drops into your workflow.

Runs every night. Or before a big release.

Everything that ships in the six-month engagement.

Built for fast triage and faster fixes.

CISO at an essential or important entity

Head of Compliance at a financial entity

Head of AI / DPO at an AI deployer

Run Heatshield against your codebase.

Product

Support

Company

Product

Your codebase is full of bugs.

Three workflows. End to end. Live on day one.

Find serious bugs in your codebase.

Drops into your workflow.

Runs every night. Or before a big release.

Everything that ships in the six-month engagement.

Built for fast triage and faster fixes.

CISO at an essential or important entity

Head of Compliance at a financial entity

Head of AI / DPO at an AI deployer

Run Heatshield against your codebase.