CodeQL traces data through code as a database. Aevral reads access rules across the whole repository. Both are deep; they are deep about different things.
| Row | CodeQL | Aevral |
|---|---|---|
| Question it answers | What does the dataflow through this code expose? | Who has access to what, and did this change widen it? |
| Stated job | Semantic analysis with dataflow queries over a code database | Access-control and business-logic reading of the repo, and a wider security reading of the PR diff |
| Where it runs | GitHub code scanning and the CodeQL CLI, per GitHub's docs | Console scan on the default branch; PR review, live on install |
| Unit of work | The query result, over the codebase as data | The finding as a lead with evidence, across files |
| Complementary? | Yes | Yes |
CodeQL treats your codebase as a queryable database and runs dataflow queries over it. That is a powerful shape of analysis, and it is what GitHub code scanning runs on. Aevral is not a query engine: it is a reader. It goes through the repository snapshot looking for access control and business logic, the way a security researcher reads a change, with the cross-file context of who is allowed to access what; its PR review rides the same App, live on install, reading a wider class list on the diff.
Dataflow analysis and access-control reading answer different questions, so the tools complement each other. This page keeps to the boundary: CodeQL's stated job on one side, Aevral's job on the other, no claims about results on your code.
CodeQL
CodeQL is GitHub's semantic code analysis engine. It models code as a database and runs dataflow queries over it to find security vulnerabilities, powering code scanning on GitHub.
Aevral
Security review, handled. PR review, live on install, looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the diff. Paid PR plans are live in the console. The whole-repo scan is live and self-serve, and reads authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a human decides. No patches are auto-applied.
This change tightens nothing and breaks nothing: an equality check on the organization id becomes a prefix check, probably to support a planned org-hierarchy feature. The code is valid and every test still passes.
export function canAccess(user: User, ws: Workspace) { if (ws.orgId === user.orgId) return grant(ws) if (ws.orgId.startsWith(user.orgId)) return grant(ws) return deny(ws)}The org acme-1 now matches the user org acme, so members of one organization can reach another organization's workspace. The whole change is a comparison operator on a string, and the access it grants is the finding. Aevral is built to read the diff for the rule the change quietly rewrites.
Keep CodeQL for semantic dataflow analysis over the codebase; run Aevral for the access-control reading of the repository, and a wider security reading of your pull requests through its PR review, live on install.
No. CodeQL does its stated job and keeps doing it. Aevral runs alongside it with its own reading: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security on the pull requests it reviews, and its whole-repo scan reads access control and business logic across the repository at rest.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: CodeQL and Aevral on the works-alongside page.
See the wider field: CodeQL alternatives.
Primary sources: CodeQL documentation; GitHub code scanning; Aevral whole-repo scan; Aevral PR security review.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.