Nullify drives product-security findings to merge-ready fixes; Aevral adds a reading focused on the authorization and business-logic questions: a live opt-in PR review on the pull request, and a whole-repo scan at rest.
| Row | Nullify | Aevral |
|---|---|---|
| Question it answers | Which validated risks need fixes this week? | Who has access to what, and does this change widen it? |
| Stated job | Autonomous product security: detection, exploit validation, triage, and merge-ready remediation PRs driven to closure, plus pentest, secrets, and cloud, per Nullify's site | Authorization, IDOR, and business-logic reading of the PR diff, and of the whole-repo snapshot at rest |
| Where it runs | Nullify cloud over your repositories, tickets, and chat; priced on work performed | GitHub Check and inline comments, opt-in per organization; scans run from the console on a chosen SHA |
| Unit of work | Merge-ready fix PRs with self-healing follow-ups; your team keeps merge approval | Up to two findings per opt-in review, grounded on the added lines; scan findings come as leads with evidence |
| Complementary? | Yes | Yes |
Nullify describes an autonomous system of agents that drives product-security work to closure: findings are validated for exploitability, triaged against your risk model, and fixed with merge-ready PRs that refactor themselves until checks pass, with escalation reserved for decisions that need a human, per Nullify's site. Its business-logic section names broken access control, privilege escalation, insecure workflows, IDOR, and race conditions as the flaws it reasons about. Aevral is built for a reading of its own: does a change widen who has access to what, an authorization, IDOR, or business-logic access-control issue. Good code and safe access are separate properties; a change can read well while moving the other.
Nullify publishes broken access control and IDOR in its detection scope, and its remediation PRs land in the same pull-request flow; Aevral's single job is the access reading, at rest and on the pull request, with findings as leads and no patches: the fix is a prompt you hand to the coding agent you already use. With Aevral's PR review, live and opt-in, both run on the same pull request; Aevral also reads the repository snapshot at rest as a whole-repo scan. The framing stays complementary: each tool does the job it publishes, and this page makes no claim about results on your pull requests.
Nullify
Nullify is an autonomous product-security system. Its published loop drives product-security work from detection through exploit validation, triage, and merge-ready remediation PRs (with self-healing follow-up commits) to closure, alongside secrets detection, an AI pentest agent, exploit validation, and cloud security, per Nullify's site. It is priced on work performed; merge approval stays with your team.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change moves API key rotation into the settings background job because the manual flow was unused. The rotation runs, the audit line is written, and the tests that rotate seeded keys still pass.
export async function rotate(keyId: string, actor) { await requireOwner(actor, keyId) await assertSignedIn(actor) return rotateKey(keyId)The actor is signed in, the rotation runs, and the audit line is written. What changed is the check: the owner assertion became a bare signed-in assertion, so any signed-in user who can name a key id rotates it, cutting out the real owner's access. That is the Broken Object Level Authorization shape (OWASP API1:2023): the object reference is caller-controlled and the server stopped binding it to the owner. Aevral is built to read a diff for the binding that left, not the job that stayed.
Keep Nullify for autonomous remediation driven to merge-ready PRs; run Aevral for the authorization and business-logic reading of the same pull requests and the whole-repo snapshot, opt-in per organization.
No. Nullify does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Nullify and Aevral on the works-alongside page.
Primary sources: Nullify; Nullify code security; Aevral PR security review; Aevral whole-repo scan.
One GitHub App. A report with evidence. A prompt for the agent you already use.