vendor/heap · vendor documented

Heap loaders put the environment ID in the path

Heap.js 5 loads /config/{envId}/heap_config.js from cdn.us.heap-api.com or cdn.eu.heap-api.com. envId is the numeric environment ID from Heap Projects. Classic heap-{id}.js on cdn.heapanalytics.com is vendor/heap-classic. Server-side /api/track is vendor/heap-track. Identify is vendor/heap-identify.

What this pack matches

Hosts: cdn.us.heap-api.com, cdn.eu.heap-api.com
Paths: …/heap_config.js…
Vendor docs: developers.heap.io/docs/web

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`env_id`	required	It is the Heap environment ID (app ID). Heap documents the loader as `cdn.us.heap-api.com/config/{YOUR_APP_ID}/heap_config.js`. Fix: Copy the snippet from Heap Projects so the path is `/config/{envId}/heap_config.js`.	`vendor.heap.param.env_id.missing` `vendor.heap.param.env_id.empty` `vendor.heap.param.env_id.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/heap

Try this failing payload in the playground. Heap config loader missing environment ID.

https://cdn.us.heap-api.com/config/heap_config.js

cargo install pixellint · npm install pixellint