AI-based vulnerability scanning

GitHub AI Scan and Aevral, at a glance

GitHub AI Scan is GitHub's own AI-based scanning engine, layered onto code scanning, finding vulnerabilities including broken access control in pull requests for languages CodeQL's built-in analysis does not cover today (PHP, Shell/Bash, Terraform, Dockerfiles, JSP, Blazor), per GitHub's documentation.

AI Scan fills the language gap: it runs on a pull request once code scanning and the repository's AI Scan setting are enabled, finding vulnerabilities across nine categories, including broken access control, in languages CodeQL doesn't cover, per GitHub's documentation.

Findings are advisory and do not block a merge through a ruleset. Aevral reads the access rules on the same pull request, across every language its PR review supports, through its PR review, live on install.

GitHub AI Scan focuses on

AI-based scanning for vulnerabilities on the pull request diff, including broken access control, string injection, and SSRF, per GitHub's documentation.
Languages and frameworks CodeQL's built-in analysis does not cover today: PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP for Java, and Blazor for C#, per GitHub's documentation.
A finding labelled AI on the Conversation and Files changed tabs, with an optional suggested autofix, per GitHub's documentation.

Aevral adds alongside

The access reading of the same pull request: dropped ownership checks, caller-controlled scope or object references, and gates that went from a role to a login.
Live on install: up to five findings per review, grounded on the added lines, posted as a Check plus inline comments. It never blocks a merge.
A fix prompt you hand to the coding agent you already use, with a human reviewing before merge.

Run them together

Let AI Scan cover the languages CodeQL doesn't reach; let Aevral add its access-control and business-logic reading of the same pull requests, live on install.

GitHub AI Scan and Aevral, in depth; Aevral PR security review.

Security review, handled.

Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.

Install the GitHub App Log in Sign up

For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.