Use case · Engineering

Bug triage: from no idea where to look to three suspects

A bug report lands. Hedy searches the code, walks the commit window, matches known failure patterns and names likely owners — with an honest confidence level on every conclusion. Strictly read-only: no code changes, no auto-assign.

Hedy investigates bugs read-only: it searches the codebase, narrows the commit time window around when the regression appeared, matches against a pattern library of known failure shapes, and attributes likely owners from code history. Every finding carries a self-rated confidence (HIGH/MEDIUM/LOW) and, under the evidence gate, quotes the exact lines and commits it relied on. It never edits code — one Hedy runs a full triage lane, not a chat seat.

Last updated: 20 July 2026

How Hedy runs it

01

Report in, keywords out

Stack traces, error strings and identifiers are extracted and searched across your repositories.

02

Commit-window analysis

"Started recently" checks 7 days of commits; "always been there" checks 30. Deploy times narrow it further.

03

Pattern memory

Every closed investigation adds to a pattern library — the triage gets sharper with each incident.

04

Confidence-rated verdict

HIGH, MEDIUM or LOW, stated plainly. A wrong certainty is worse than an honest maybe.

Governed by design

  • Strictly read-only: no code changes, no issue-state changes, no auto-assign
  • Named owners are informational — humans decide who takes it
  • Findings post to your chat; issue comments only where allowlisted

In depth

A bug report lands and Hedy runs the investigation a whole triage rotation would. It searches the repository for the failing symptom, correlates it against a commit time window — the range of changes between the last known-good state and the first failure — and matches the trace against a pattern library of recurring failure shapes (null deref, race, off-by-one in pagination, migration drift). It resolves likely owners from commit history and code ownership, so the report arrives pre-routed instead of pre-argued.

Every conclusion is graded. Hedy self-scores each finding HIGH / MEDIUM / LOW: HIGH when the suspect commit, the reproducing code path, and the pattern all line up; LOW when it only has a symptom and a guess. Under the evidence gate, a claim cannot ship without quoting its source verbatim — the exact commit SHA, file, and lines. A LOW-confidence hunch is labeled a hunch, not dressed up as a root cause, so engineers spend review time on the HIGH ones.

This lane is read-only by construction, not by promise. Hedy holds no write path to your source during investigation — the default-deny whitelist governs every action, so it cannot push, force-push, or open a non-Draft PR. Any suggested fix is a Draft a human opens and merges. That constraint lives in config and code, per Hedy's iron rule that a limit written only in a prompt does not exist.

Because Hedy is self-hosted — Docker or K8s on your infrastructure, air-gap supported — your code never leaves your network to be triaged. It uses your own model keys, including local vLLM or Ollama, so no third party sees the repository. Retrieval respects the requester's ACL, and the whole run lands in an append-only audit log: which files were searched, which commits inspected, what confidence was assigned, and every source the answer quoted.

Questions

How does Hedy figure out which commit caused a bug?
Hedy establishes a commit time window between the last known-good state and the first observed failure, then searches that range for changes touching the failing code path. It matches the symptom against a pattern library of known failure shapes and ranks suspect commits. Each candidate gets a HIGH/MEDIUM/LOW confidence score, and under the evidence gate it quotes the exact commit and lines it relied on.
Will Hedy change my code or push a fix automatically?
No. Bug investigation is read-only by construction. Hedy holds no write path to your source during triage — the default-deny whitelist and Draft-only PR rule are enforced in config and code, not just prompts. Any proposed fix arrives as a Draft that a human reviews and merges. Hedy cannot push or write to a protected branch.
What does the confidence score actually mean?
Hedy grades each finding HIGH, MEDIUM, or LOW based on how much corroborating evidence it has. HIGH means the suspect commit, the reproducing code path, and a known pattern all align. LOW means it has a symptom and a plausible guess but no verified chain. The label is honest by design, so engineers triage the strong leads first instead of chasing dressed-up hunches.
Does my source code leave our network for Hedy to analyze it?
No. Hedy is self-hosted on your own infrastructure — Docker, Kubernetes, or air-gapped — and calls your own model keys, including local vLLM or Ollama. There are no sub-processors. Code search, commit analysis, and owner attribution all run inside your perimeter, and every run is recorded in an append-only audit log with the sources each answer cited.

Related

hedy.one

See it on your own infrastructure.

Book a demo