Semantic code analysis

CodeQL and Aevral, at a glance

CodeQL models code as a database and runs dataflow queries over it to find security vulnerabilities. It powers GitHub code scanning.

CodeQL is a query engine: it treats your codebase as a database and runs dataflow queries over it, and that is what GitHub code scanning runs on. Aevral is a reader: it goes through the repository snapshot the way a security researcher reads a change, looking for access control and business logic with the cross-file context of who is allowed to access what. Query analysis and access-control reading are different jobs, so the two complement each other.

CodeQL focuses on

Modeling the codebase as a queryable database.
Dataflow queries for security vulnerabilities.
Powering GitHub code scanning.

Aevral adds alongside

The access-rule reading: gates, roles, and tenant bindings, read across files with the context of who is allowed to access what.
The pull-request reading for access-control changes, live on install.
A finding as a lead with evidence: a human decides what matters.

Run them together

Let CodeQL run the dataflow queries; let Aevral read the access rules across the repository.

CodeQL and Aevral, in depth; Aevral whole-repo scan.

Also alongside

Security review, handled.

Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.

Install the GitHub App Log in Sign up

For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.