Semgrep matches rules and publishes AI-powered detection that includes IDOR and broken authorization; Aevral stays a reading of its own: who has access to what. Two overlapping scopes on the same repository, and the split is stated on this page.
| Row | Semgrep | Aevral |
|---|---|---|
| Question it answers | Does the code match a rule, and does AI-powered detection flag exploitable patterns? | Who has access to what, and did this change widen it? |
| Stated job | Rule-based static analysis with custom rules; AI-powered detection whose published scope includes IDOR and broken authorization, per Semgrep's site | Authorization, IDOR, and business-logic reading of the repo and PR diff |
| Where it runs | Editor, CLI, and CI, per Semgrep's docs | Console scan on the default branch; PR review opt-in per organization |
| Unit of work | The rule match, at line level | The finding as a lead with evidence, across files |
| Complementary? | Yes | Yes |
Semgrep is built to scan code against rules: the published security rules, and the custom ones your team writes for your own patterns, at line level, in the editor, CLI, and CI. Its AI-powered detection publishes IDOR and broken authorization among its scope, per Semgrep's site. Aevral is built for a reading of its own: it goes through the repository snapshot looking for authorization, IDOR, and business-logic access control, with cross-file context, and its PR review rides the same App as an opt-in add-on.
The scopes overlap, and the split above states what each publishes. Teams that run both tend to point Semgrep at line-level rule enforcement and Aevral at the cross-file access reading; both do the jobs they publish, and neither result replaces your own review.
Semgrep
Semgrep is a static analysis engine. It scans code against security and correctness rules, including custom rules teams write themselves, and runs in the editor, CLI, and CI.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change moves the tenant selector from the session to a query parameter, probably to make a mobile client simpler. The code is valid, it compiles, the endpoint returns exactly what it is asked for.
export async function GET(req: Request) { const tenant = session.tenantId const tenant = new URL(req.url).searchParams.get("tenant") return listOrders(tenant)}The tenant id used to be bound to the signed-in session; now it comes from the caller. Anyone who can name a tenant id can list that tenant's orders, which is an IDOR: the object reference is attacker-controlled and the server no longer binds it to the session. Aevral is built to read a diff for exactly this: the line where a server-side binding becomes a caller-side parameter.
Keep Semgrep for rule-based scanning in the editor, CLI, and CI; run Aevral for the authorization and business-logic reading of the repository, and of every pull request through its opt-in PR review.
No. Semgrep does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: Semgrep and Aevral on the works-alongside page.
See the wider field: Semgrep alternatives.
Primary sources: Semgrep documentation; Semgrep product page; Aevral whole-repo scan; Aevral PR security review.
One GitHub App. A report with evidence. A prompt for the agent you already use.