SonarQube analyzes code quality and security across branches and pull requests and gates the results; Aevral adds a reading focused on the authorization and business-logic questions: a live opt-in PR review on the pull request, and a whole-repo scan at rest.
| Row | SonarQube | Aevral |
|---|---|---|
| Question it answers | Does this change meet the quality and security gate? | Who has access to what, and does this change widen it? |
| Stated job | Quality and security analysis on branches and pull requests, quality gates, AI Code Assurance, AI CodeFix, and the Hunter Agent for logic flaws, per Sonar's site | Authorization, IDOR, and business-logic reading of the PR diff, and of the whole-repo snapshot at rest |
| Where it runs | SonarQube Cloud or SonarQube Server, in CI/CD and the IDE, per Sonar's docs | GitHub Check and inline comments, opt-in per organization; scans run from the console on a chosen SHA |
| Unit of work | Issues and security hotspots against rules and gates; the Hunter Agent hunts logic flaws | Up to two findings per opt-in review, grounded on the added lines; scan findings come as leads with evidence |
| Complementary? | Yes | Yes |
SonarQube runs deep static analysis on branches and pull requests, enforces quality gates, and tracks quality and security across the codebase, with AI Code Assurance for code produced by coding agents and AI CodeFix for suggested repairs, per Sonar's site. Its Hunter Agent extends the platform with what Sonar calls an AI security agent that hunts logic flaws. Aevral is built for a reading of its own: does a change widen who has access to what, an authorization, IDOR, or business-logic access-control issue. Good code and safe access are separate properties; a change can read well while moving the other.
Sonar publishes logic flaws in the Hunter Agent's scope (their words: an AI security agent that hunts logic flaws), and its taint analysis reads data flow for injection classes; Aevral's single job is the access reading, at rest and on the pull request. With Aevral's PR review, live and opt-in, both run on the same pull request; Aevral also reads the repository snapshot at rest as a whole-repo scan. The framing stays complementary: each tool does the job it publishes, and this page makes no claim about results on your pull requests.
SonarQube
SonarQube is a code quality and security platform. It runs static analysis on branches and pull requests, enforces quality gates, assures AI-generated code with AI Code Assurance, and suggests fixes with AI CodeFix, per Sonar's site. Its SonarQube Hunter Agent, available on SonarQube Cloud Enterprise and announced for SonarQube Server in 2026-08, is what Sonar calls an AI security agent that hunts logic flaws.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change flattens two guards into one because the export already writes an audit line for each call. The route passes the signed-in check, the log line appears, and the tests that exercise the happy path still pass.
export async function exportWorkspace(req, user) { assertRole(user, 'admin', req.workspaceId) assertSignedIn(user) return stream(await collect(req.workspaceId))The user is signed in, the audit line is written, and the export still streams. What changed is the check: the workspace-scoped admin assertion became a bare signed-in assertion, so any member who can name this workspace id can export its data. That is the Broken Function Level Authorization shape (OWASP API5:2023): the function is reachable by principals the check no longer binds to the workspace. Aevral is built to read a diff for the binding that left, not the audit line that stayed.
Keep SonarQube for the quality gate and the platform's security analysis; run Aevral for the authorization and business-logic reading of the same pull requests and the whole-repo snapshot, opt-in per organization.
No. SonarQube does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: SonarQube and Aevral on the works-alongside page.
Primary sources: SonarQube; SonarQube AI Code Assurance; Announcing the SonarQube Hunter Agent; Aevral PR security review; Aevral whole-repo scan.
One GitHub App. A report with evidence. A prompt for the agent you already use.