Nullify drives product-security findings to merge-ready fixes; Aevral adds a reading focused on the authorization and business-logic questions: PR review, live on install, on the pull request, and a whole-repo scan at rest.
| Row | Nullify | Aevral |
|---|---|---|
| Question it answers | Which validated risks need fixes this week? | Who has access to what, and does this change widen it? |
| Stated job | Autonomous product security: detection, exploit validation, triage, and merge-ready remediation PRs driven to closure, plus pentest, secrets, and cloud, per Nullify's site | Security reading of the PR diff (access control, business logic, injection, XSS, SSRF, path traversal, LLM integration), and an access-control and business-logic reading of the whole-repo snapshot at rest |
| Where it runs | Nullify cloud over your repositories, tickets, and chat; priced on work performed | GitHub Check and inline comments, live on install; scans run from the console on a chosen SHA |
| Unit of work | Merge-ready fix PRs with self-healing follow-ups; your team keeps merge approval | Up to five findings per review, grounded on the added lines; scan findings come as leads with evidence |
| Complementary? | Yes | Yes |
Nullify describes an autonomous system of agents that drives product-security work to closure: findings are validated for exploitability, triaged against your risk model, and fixed with merge-ready PRs that refactor themselves until checks pass, with escalation reserved for decisions that need a human, per Nullify's site. Its business-logic section names broken access control, privilege escalation, insecure workflows, IDOR, and race conditions as the flaws it reasons about. Aevral is built for a reading of its own: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the change, and its whole-repo scan reads who has access to what: authorization, IDOR, and business-logic access control. Good code and safe access are separate properties; a change can read well while moving the other.
Nullify publishes broken access control and IDOR in its detection scope, and its remediation PRs land in the same pull-request flow; Aevral reads access control and business logic at rest, and a wider security class list on the pull request, with findings as leads and no auto-applied fixes: a finding can carry a suggested diff you apply, plus a prompt you hand to the coding agent you already use. With Aevral's PR review, live on install, both run on the same pull request; Aevral also reads the repository snapshot at rest as a whole-repo scan, for access control and business logic only. The framing stays complementary: each tool does the job it publishes, and this page makes no claim about results on your pull requests.
Nullify
Nullify is an autonomous product-security system. Its published loop drives product-security work from detection through exploit validation, triage, and merge-ready remediation PRs (with self-healing follow-up commits) to closure, alongside secrets detection, an AI pentest agent, exploit validation, and cloud security, per Nullify's site. It is priced on work performed; merge approval stays with your team.
Aevral
Security review, handled. PR review, live on install, looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the diff. Paid PR plans are live in the console. The whole-repo scan is live and self-serve, and reads authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a human decides. No patches are auto-applied.
This change moves API key rotation into the settings background job because the manual flow was unused. The rotation runs, the audit line is written, and the tests that rotate seeded keys still pass.
export async function rotate(keyId: string, actor) { await requireOwner(actor, keyId) await assertSignedIn(actor) return rotateKey(keyId)The actor is signed in, the rotation runs, and the audit line is written. What changed is the check: the owner assertion became a bare signed-in assertion, so any signed-in user who can name a key id rotates it, cutting out the real owner's access. That is the Broken Object Level Authorization shape (OWASP API1:2023): the object reference is caller-controlled and the server stopped binding it to the owner. Aevral is built to read a diff for the binding that left, not the job that stayed.
Keep Nullify for autonomous remediation driven to merge-ready PRs; run Aevral for its security reading of the same pull requests and the access-control reading of the whole-repo snapshot, live on install.
No. Nullify does its stated job and keeps doing it. Aevral runs alongside it with its own reading: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security on the pull requests it reviews, and its whole-repo scan reads access control and business logic across the repository at rest.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Nullify and Aevral on the works-alongside page.
Primary sources: Nullify; Nullify code security; Aevral PR security review; Aevral whole-repo scan.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.