Semgrep matches rules and publishes AI-powered detection that includes IDOR and broken authorization; Aevral stays a reading of its own: who has access to what. Two overlapping scopes on the same repository, and the split is stated on this page.
| Row | Semgrep | Aevral |
|---|---|---|
| Question it answers | Does the code match a rule, and does AI-powered detection flag exploitable patterns? | Who has access to what, and did this change widen it? |
| Stated job | Rule-based static analysis with custom rules; AI-powered detection whose published scope includes IDOR and broken authorization, per Semgrep's site | Access-control and business-logic reading of the repo, and a wider security reading of the PR diff |
| Where it runs | Editor, CLI, and CI, per Semgrep's docs | Console scan on the default branch; PR review, live on install |
| Unit of work | The rule match, at line level | The finding as a lead with evidence, across files |
| Complementary? | Yes | Yes |
Semgrep is built to scan code against rules: the published security rules, and the custom ones your team writes for your own patterns, at line level, in the editor, CLI, and CI. Its AI-powered detection publishes IDOR and broken authorization among its scope, per Semgrep's site. Aevral is built for a reading of its own: it goes through the repository snapshot looking for access control and business logic, with cross-file context, and its PR review rides the same App, live on install, reading a wider class list on the diff.
The scopes overlap, and the split above states what each publishes. Teams that run both tend to point Semgrep at line-level rule enforcement and Aevral at the cross-file access reading; both do the jobs they publish, and neither result replaces your own review.
Semgrep
Semgrep is a static analysis engine. It scans code against security and correctness rules, including custom rules teams write themselves, and runs in the editor, CLI, and CI.
Aevral
Security review, handled. PR review, live on install, looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the diff. Paid PR plans are live in the console. The whole-repo scan is live and self-serve, and reads authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a human decides. No patches are auto-applied.
This change moves the tenant selector from the session to a query parameter, probably to make a mobile client simpler. The code is valid, it compiles, the endpoint returns exactly what it is asked for.
export async function GET(req: Request) { const tenant = session.tenantId const tenant = new URL(req.url).searchParams.get("tenant") return listOrders(tenant)}The tenant id used to be bound to the signed-in session; now it comes from the caller. Anyone who can name a tenant id can list that tenant's orders, which is an IDOR: the object reference is attacker-controlled and the server no longer binds it to the session. Aevral is built to read a diff for exactly this: the line where a server-side binding becomes a caller-side parameter.
Keep Semgrep for rule-based scanning in the editor, CLI, and CI; run Aevral for the access-control reading of the repository, and a wider security reading of your pull requests through its PR review, live on install.
No. Semgrep does its stated job and keeps doing it. Aevral runs alongside it with its own reading: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security on the pull requests it reviews, and its whole-repo scan reads access control and business logic across the repository at rest.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Semgrep and Aevral on the works-alongside page.
See the wider field: Semgrep alternatives.
Primary sources: Semgrep documentation; Semgrep product page; Aevral whole-repo scan; Aevral PR security review.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.