[Static analysis (SAST)]

Semgrep and Aevral, at a glance

Semgrep scans code against security and correctness rules, including custom rules teams write themselves, in the editor, CLI, and CI, and publishes AI-powered detection that includes IDOR and broken authorization, per Semgrep's site.

Semgrep is built to scan code against rules: the published security rules and your own custom ones, at line level, and it publishes AI-powered detection that includes IDOR and broken authorization, per Semgrep's site. Aevral is built for a reading of its own: it goes through the repository snapshot looking for authorization, IDOR, and business-logic access control, with cross-file context, and its opt-in PR review rides the same App as an add-on. The scopes overlap, and each page states the split in plain words.

Semgrep focuses on

Scanning code against security and correctness rules, at line level.
Custom rules teams write for their own codebase patterns.
AI-powered detection whose published scope includes IDOR and broken authorization, per Semgrep's site.

Aevral adds alongside

The whole-repo authorization reading: which routes and handlers let whom access what, read across files with cross-file context.
The pull-request reading for access-control changes, as an opt-in add-on: up to two findings per review, grounded on the added lines.
A finding as a lead with evidence: the file, the lines, and the reason a human should look. A human decides.

Run them together

Let Semgrep run the rule-based scans wherever you build; let Aevral read who has access to what across the repository.

Semgrep and Aevral, in depth; Aevral whole-repo scan.

Also alongside

Scan your whole repo for access bugs.

One GitHub App. A report with evidence. A prompt for the agent you already use.

Join waitlist