[Compare]

Semgrep and Aevral

Semgrep matches rules and publishes AI-powered detection that includes IDOR and broken authorization; Aevral stays a reading of its own: who has access to what. Two overlapping scopes on the same repository, and the split is stated on this page.

Same repository, two questions.
RowSemgrepAevral
Question it answersDoes the code match a rule, and does AI-powered detection flag exploitable patterns?Who has access to what, and did this change widen it?
Stated jobRule-based static analysis with custom rules; AI-powered detection whose published scope includes IDOR and broken authorization, per Semgrep's siteAuthorization, IDOR, and business-logic reading of the repo and PR diff
Where it runsEditor, CLI, and CI, per Semgrep's docsConsole scan on the default branch; PR review opt-in per organization
Unit of workThe rule match, at line levelThe finding as a lead with evidence, across files
Complementary?YesYes

Semgrep is built to scan code against rules: the published security rules, and the custom ones your team writes for your own patterns, at line level, in the editor, CLI, and CI. Its AI-powered detection publishes IDOR and broken authorization among its scope, per Semgrep's site. Aevral is built for a reading of its own: it goes through the repository snapshot looking for authorization, IDOR, and business-logic access control, with cross-file context, and its PR review rides the same App as an opt-in add-on.

The scopes overlap, and the split above states what each publishes. Teams that run both tend to point Semgrep at line-level rule enforcement and Aevral at the cross-file access reading; both do the jobs they publish, and neither result replaces your own review.

Semgrep

Semgrep is a static analysis engine. It scans code against security and correctness rules, including custom rules teams write themselves, and runs in the editor, CLI, and CI.

Aevral

Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.

Valid code that lets callers name their own tenant.

This change moves the tenant selector from the session to a query parameter, probably to make a mobile client simpler. The code is valid, it compiles, the endpoint returns exactly what it is asked for.

api/orders/route.ts+1 −1
export async function GET(req: Request) {  const tenant = session.tenantId  const tenant = new URL(req.url).searchParams.get("tenant")  return listOrders(tenant)}
AevralIDOR

The tenant id used to be bound to the signed-in session; now it comes from the caller. Anyone who can name a tenant id can list that tenant's orders, which is an IDOR: the object reference is attacker-controlled and the server no longer binds it to the session. Aevral is built to read a diff for exactly this: the line where a server-side binding becomes a caller-side parameter.

Run them together

Keep Semgrep for rule-based scanning in the editor, CLI, and CI; run Aevral for the authorization and business-logic reading of the repository, and of every pull request through its opt-in PR review.

Questions engineers ask

Does Aevral replace Semgrep?

No. Semgrep does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.

Is this a catch-rate comparison?

No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.

When can I run this?

Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.

More comparisons

The shorter version, at a glance: Semgrep and Aevral on the works-alongside page.

See the wider field: Semgrep alternatives.

Primary sources: Semgrep documentation; Semgrep product page; Aevral whole-repo scan; Aevral PR security review.


Scan your whole repo for access bugs.

One GitHub App. A report with evidence. A prompt for the agent you already use.