Two readings on one pull request: Bugbot doing its review, and Aevral, through its opt-in PR review, adding the authorization and business-logic reading.
| Row | Cursor Bugbot | Aevral |
|---|---|---|
| Question it answers | What problems does this change carry? | Who has access to what, and does this change widen it? |
| Stated job | Flags likely bugs, quality problems, and security issues on the PR | Authorization, IDOR, and business-logic reading of the PR diff |
| Where it runs | The Cursor workflow and the GitHub pull request, per Cursor's docs | GitHub Check and inline comments, opt-in per organization |
| Unit of work | The review flag on the change | Up to two findings per review, grounded on the added lines |
| Complementary? | Yes | Yes |
Bugbot is built to review the change itself: likely bugs, quality problems, and security issues, in the Cursor workflow, before merge. Aevral is built for a different reading: does this diff widen who has access to what, the authorization, IDOR, and business-logic access-control reading. Those are different readings of the same change, and a change can look clean while quietly redefining access.
The framing is addition, not replacement: Bugbot doing the review it states, and Aevral adding the authorization and business-logic reading, side by side on the same pull request with Aevral's opt-in PR review. Aevral also reads the repository at rest. This page makes no claim about results on your code.
Bugbot
Cursor Bugbot is an AI code reviewer. It reviews each pull request and flags likely bugs, code-quality problems, and security issues before they merge.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change removes the server-side check on coupon usage, because the new frontend already validates the cap before submitting. The code is clean and the redemption flow works exactly as designed.
export async function POST(req: Request) { const { cart, code } = await req.json() if (coupon.uses >= coupon.maxUses) throw new Exhausted() return applyDiscount(cart, code)}The client validates nothing that matters: callers are not the client. With the server check gone, the usage cap is advisory, and any caller can redeem past the limit. The program still runs exactly as designed, and the rule behind it is gone, which is the class Aevral reads for: a change that keeps the feature working while quietly removing the control.
Keep Bugbot for problems in the change on every pull request; run Aevral for the authorization and business-logic reading of the same diff, opt-in per organization.
No. Bugbot does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Cursor Bugbot and Aevral on the works-alongside page.
Primary sources: Cursor Bugbot documentation; Cursor Bugbot product page; Aevral PR security review; Aevral whole-repo scan.
One GitHub App. A report with evidence. A prompt for the agent you already use.