Two readings on one pull request: Hacktron's call-graph review and the proof-of-concept fix it attaches, and Aevral, through its PR review, live on install, adding its own security reading of the same change.
| Row | Hacktron | Aevral |
|---|---|---|
| Question it answers | Given the call graph behind this change, is there an exploitable vulnerability, with a proof-of-concept attached? | Who has access to what, and does this change widen it? |
| Stated job | AI-native security code review and penetration testing across indexed repositories and call graphs, per Hacktron's documentation | Security reading of the PR diff: access control, business logic, injection, XSS, SSRF, path traversal, LLM integration |
| Where it runs | GitHub, GitLab, Bitbucket, or Azure DevOps, posting findings on the vulnerable lines, per Hacktron's documentation | GitHub Check and inline comments, live on install; scans run from the console on a chosen SHA |
| Unit of work | A finding with a proof-of-concept and an AI fix prompt, auto-resolved once the next commit patches it, per Hacktron's documentation | Up to five findings per review, grounded on the added lines; scan findings come as leads with evidence |
| Complementary? | Yes | Yes |
Hacktron is built as an AI-native security platform for code review and penetration testing: it reviews pull requests against indexed repositories and call graphs instead of the diff alone, and names broken access control, business logic flaws, injection, SSRF, XXE, prompt injection, and memory-safety bugs among the classes it looks for, attaching a proof-of-concept and an AI fix prompt to each finding, per Hacktron's documentation. Aevral reads the same question on the diff that opened the pull request: whether the change widens who has access to what, grounded in the lines actually changed, with a suggested fix prompt a human or their agent applies. Aevral never opens, pushes, or merges a pull request on its own.
The framing is addition, not replacement: Hacktron's call-graph review and the fixes it proposes across connected repositories, and Aevral adding its own authorization and business-logic reading of the same pull requests with its PR review, live on install, plus a whole-repo scan for the same classes. This page makes no claim about results on your code.
Hacktron
Hacktron is an AI-native security platform for code review and penetration testing. It reviews pull requests against indexed repositories and call graphs instead of the diff alone, and names broken access control, business logic flaws, injection, SSRF, and other classes among what it looks for, per Hacktron's documentation.
Aevral
Security review, handled. PR review, live on install, looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the diff. Paid PR plans are live in the console. The whole-repo scan is live and self-serve, and reads authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a human decides. No patches are auto-applied.
This change lets a signed-in user accept a pending team invite from a link. The handler still loads the invite record by its token, but the role written to the new membership now comes from the request body instead of the role stored on the invite.
export async function POST(req: Request) { const session = await requireSession(req); const invite = await db.invite.findUnique({ where: { token: token(req) } }); const { role } = await req.json(); await db.member.create({ data: { userId: session.userId, orgId: invite.orgId, role: invite.role } }); await db.member.create({ data: { userId: session.userId, orgId: invite.orgId, role } }); return Response.json({ ok: true });}requireSession confirms the caller is signed in, and the invite record still holds the role it was issued with, but the membership write now takes role from the request body instead of invite.role. Anyone holding a valid invite link can accept it while sending any role value, including an admin role the invite was never issued with. That is a privilege-escalation flaw (CWE-269, Improper Privilege Management) on a path with no injection, no raw query, and no pattern a dependency or syntax scanner looks for: the code is well-formed and the types check. That is the shape of issue Aevral is built to read on a diff.
Keep Hacktron for its call-graph review across connected repositories and the fixes it proposes; run Aevral for its own authorization and business-logic reading of the same pull requests, live on install.
No. Hacktron does its stated job and keeps doing it. Aevral runs alongside it with its own reading: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security on the pull requests it reviews, and its whole-repo scan reads access control and business logic across the repository at rest.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Hacktron and Aevral on the works-alongside page.
Primary sources: Hacktron: AI code review and SAST for pull and merge requests; Hacktron docs: code reviews; Aevral PR security review; Aevral whole-repo scan.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.