Two readings on one pull request: Copilot code review doing its review, and Aevral, through its opt-in PR review, adding the authorization and business-logic reading.
| Row | Copilot code review | Aevral |
|---|---|---|
| Question it answers | How can this pull request improve? | Who has access to what, and does this change widen it? |
| Stated job | Reviews pull requests for bugs, quality, and security issues | Authorization, IDOR, and business-logic reading of the PR diff |
| Where it runs | In the GitHub pull request, per GitHub's docs | GitHub Check and inline comments, opt-in per organization |
| Unit of work | The review comment and suggested fix | Up to two findings per review, grounded on the added lines |
| Complementary? | Yes | Yes |
Copilot code review runs where you already merge: it reviews each pull request for bugs, code-quality issues, and security issues, and suggests fixes in the GitHub UI. Aevral is built for a different reading: does this diff widen who has access to what, an authorization, IDOR, or business-logic access-control issue. Good code and safe access are separate properties; a change can read well while moving the other.
With Aevral's opt-in PR review, the two reviews sit side by side on the same pull request: Copilot code review doing the review it states, and Aevral adding the authorization and business-logic reading. Aevral also reads the repository snapshot at rest. This page keeps the framing complementary; it makes no claim about results on your pull requests.
Copilot
GitHub Copilot code review is GitHub's built-in AI reviewer. It reviews pull requests for bugs, code-quality issues, and security issues, and suggests fixes directly in the pull request.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change adds a listing endpoint so a teammate can debug user reports, copied from an existing route and mounted without a guard. The code is valid, it works, and it is genuinely useful.
export async function GET() { const users = await db.users.list() return Response.json(users)}The route works, which is the problem: it has no authorization gate at all, and it returns every user row. New route, no gate, sensitive data, production mount. Aevral is built to read an added route for the access question first: who can call this, and what do they get.
Keep Copilot code review for bugs, quality, and security on every pull request; run Aevral for the authorization and business-logic reading of the same diff, opt-in per organization.
No. Copilot does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: GitHub Copilot code review and Aevral on the works-alongside page.
Primary sources: GitHub Copilot code review documentation; Aevral PR security review; Aevral whole-repo scan.
One GitHub App. A report with evidence. A prompt for the agent you already use.