CodeQL traces data through code as a database. Aevral reads access rules across the whole repository. Both are deep; they are deep about different things.
| Row | CodeQL | Aevral |
|---|---|---|
| Question it answers | What does the dataflow through this code expose? | Who has access to what, and did this change widen it? |
| Stated job | Semantic analysis with dataflow queries over a code database | Authorization, IDOR, and business-logic reading of the repo and PR diff |
| Where it runs | GitHub code scanning and the CodeQL CLI, per GitHub's docs | Console scan on the default branch; PR review opt-in per organization |
| Unit of work | The query result, over the codebase as data | The finding as a lead with evidence, across files |
| Complementary? | Yes | Yes |
CodeQL treats your codebase as a queryable database and runs dataflow queries over it. That is a powerful shape of analysis, and it is what GitHub code scanning runs on. Aevral is not a query engine: it is a reader. It goes through the repository snapshot looking for authorization, IDOR, and business-logic access control, the way a security researcher reads a change, with the cross-file context of who is allowed to access what; its PR review rides the same App as an opt-in add-on.
Dataflow analysis and access-control reading answer different questions, so the tools complement each other. This page keeps to the boundary: CodeQL's stated job on one side, Aevral's job on the other, no claims about results on your code.
CodeQL
CodeQL is GitHub's semantic code analysis engine. It models code as a database and runs dataflow queries over it to find security vulnerabilities, powering code scanning on GitHub.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change tightens nothing and breaks nothing: an equality check on the organization id becomes a prefix check, probably to support a planned org-hierarchy feature. The code is valid and every test still passes.
export function canAccess(user: User, ws: Workspace) { if (ws.orgId === user.orgId) return grant(ws) if (ws.orgId.startsWith(user.orgId)) return grant(ws) return deny(ws)}The org acme-1 now matches the user org acme, so members of one organization can reach another organization's workspace. The whole change is a comparison operator on a string, and the access it grants is the finding. Aevral is built to read the diff for the rule the change quietly rewrites.
Keep CodeQL for semantic dataflow analysis over the codebase; run Aevral for the authorization and business-logic reading of the repository, and of every pull request through its opt-in PR review.
No. CodeQL does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: CodeQL and Aevral on the works-alongside page.
Primary sources: CodeQL documentation; GitHub code scanning; Aevral whole-repo scan; Aevral PR security review.
One GitHub App. A report with evidence. A prompt for the agent you already use.