Static analysis (SAST)

Semgrep and Aevral, at a glance

Semgrep scans code against security and correctness rules, including custom rules teams write themselves, in the editor, CLI, and CI, and publishes AI-powered detection that includes IDOR and broken authorization, per Semgrep's site.

Semgrep is built to scan code against rules: the published security rules and your own custom ones, at line level, and it publishes AI-powered detection that includes IDOR and broken authorization, per Semgrep's site. Aevral is built for a reading of its own: it goes through the repository snapshot looking for access control and business logic, with cross-file context, and its PR review rides the same App, live on install, reading a wider class list on the diff. The scopes overlap, and each page states the split in plain words.

Semgrep focuses on

Scanning code against security and correctness rules, at line level.
Custom rules teams write for their own codebase patterns.
AI-powered detection whose published scope includes IDOR and broken authorization, per Semgrep's site.

Aevral adds alongside

The whole-repo authorization reading: which routes and handlers let whom access what, read across files with cross-file context.
The pull-request reading for access-control changes, live on install: up to five findings per review, grounded on the added lines.
A finding as a lead with evidence: the file, the lines, and the reason a human should look. A human decides.

Run them together

Let Semgrep run the rule-based scans wherever you build; let Aevral read who has access to what across the repository.

Semgrep and Aevral, in depth; Aevral whole-repo scan.

Also alongside

Security review, handled.

Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.

Install the GitHub App Log in Sign up

For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.