Aevral

Deep security scans for your whole repo.

Scan the repository, review the findings, hand a fix prompt to Claude Code, Cursor, or Codex. Aevral is built as an alternative to Claude Security.

Join waitlistby ISMS Copilot
Open-source modelsAuthorization / IDORNo per-seat pricing

What a scan reads

  1. Missing authorization on a routeauthorization
  2. IDOR on an object idIDOR
  3. Cross-tenant readIDOR
  4. Cross-tenant writeIDOR
  5. Caller-named tenant idIDOR
  6. Business-logic bypasslogic
  7. Gate assumed by the handlerauthorization
  8. Prefix match on an org idlogic
  9. Admin route without a role checkauthorization
  10. Debug route left mountedauthorization
The whole guide

Whole repo.
Every pull request.

A researcher on
the whole repo.

The whole repo, at rest. Press Scan, get a Check and a report with evidence, then hand a fix prompt to your agent.

Explore whole-repo scans

A reviewer on
every pull request.

Every pull request. A Check plus inline comments on the added lines, for authorization and business-logic flaws.

PR review is live and opt-in: claiming a new organization starts PR reviews on (the same default as Setup). Installing the App without claiming never authorizes reviews. Setup Complete can still turn them off. Existing opt-outs stay off, and reviews can be disabled at any time. Paid PR plans are live in the console.

Explore PR review

An example
finding.

Four illustrative findings, each played back to the line it points at: the code, the class, the explanation and the fix-prompt link. Example playback on example code, not a live scan.

api/orders/[id]/route.tsexample playback/reading
  1. 14export async function GET(req, { params }) {
  2. 15 const order = await db.order.findById(params.id)
  3. 16 return Response.json(order) // no owner check
  4. 17}
AevralHighbroken access controlexploitable
See the fix prompt

GET /orders/:id returns any order by id. No check that the record belongs to the caller's org, reachable from an unprivileged session.

example route.ts:16 on main

Example finding

From a finding
to your next move.

Claude Code · Cursor · Codex

  1. Scan

    Scan your code. Context across files, not pattern-only matching.

  2. Review

    Review findings. Each finding is a lead with evidence. You decide.

  3. Hand off

    Hand off a fix. Copy a prompt into the coding agent you already use. Nothing merges without you. Aevral does not generate patches today.

The scope,
in plain terms.

Read the transparency report, or compare with Claude Security.

Coverage
Today Aevral scans authorization, IDOR, and business-logic access control. Not memory corruption, not injection, not a general SAST. Live, self-serve.
Pricing
Per organization and usage, never per seat. Team €99 / month includes 4 default-branch scans, then €29 per scan. Excluding VAT.
All plans ↗
Models
Open-source models. Hosted in the US or the EU.
Your decision
A finding is a lead with evidence, not a confirmation. Review it before acting.

Scan your whole repo for access bugs.

One GitHub App. A report with evidence. A prompt for the agent you already use.

Join waitlist