Aevral

AI code review and security review

Factory and Aevral, at a glance

Factory's Droid reviews pull requests and runs a separate security review using STRIDE threat modeling and the OWASP Top 10, available on all plans, per Factory's site.

Factory is built as an agent-native development platform: its Droid Action reviews a pull request for concrete defects with @droid review, and runs a separate @droid security review that traces changed data flows across authentication, authorization, validation, database, network, filesystem, and LLM boundaries using STRIDE threat modeling and the OWASP Top 10, per Factory's site. Aevral is built for a reading of its own: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration flaws on the diff, and its whole-repo scan reads who has access to what: authorization, IDOR, and business-logic access control.

Factory focuses on

  • Pull-request review for concrete defects with @droid review, per Factory's site.
  • A separate @droid security review using STRIDE threat modeling, the OWASP Top 10, and the OWASP Top 10 for LLM Applications, available on all plans, per Factory's site.
  • Droid Action running both commands on GitHub and GitLab pull requests, plus a local CLI and scheduled scans, per Factory's site.

Aevral adds alongside

  • The access reading of the same change: dropped ownership checks, caller-controlled object references, and attribute lists that let a caller set fields a role should not reach.
  • Live on install: up to five findings per review, grounded on the added lines, posted as a Check plus inline comments. It never blocks a merge.
  • A fix prompt you hand to the coding agent you already use, with a human reviewing before merge.

Run them together

Let Factory's Droid run its code review and STRIDE and OWASP security review on pull requests; let Aevral add its security reading of the same pull requests, live on install.

Factory and Aevral, in depth; Aevral PR security review.

Also alongside

Security review, handled.

Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.

Install the GitHub AppLog inSign up

For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.