SonarQube analyzes code quality and security across branches and pull requests and gates the results; Aevral adds a reading focused on the authorization and business-logic questions: PR review, live on install, on the pull request, and a whole-repo scan at rest.
| Row | SonarQube | Aevral |
|---|---|---|
| Question it answers | Does this change meet the quality and security gate? | Who has access to what, and does this change widen it? |
| Stated job | Quality and security analysis on branches and pull requests, quality gates, AI Code Assurance, AI CodeFix, and the Hunter Agent for logic flaws, per Sonar's site | Security reading of the PR diff (access control, business logic, injection, XSS, SSRF, path traversal, LLM integration), and an access-control and business-logic reading of the whole-repo snapshot at rest |
| Where it runs | SonarQube Cloud or SonarQube Server, in CI/CD and the IDE, per Sonar's docs | GitHub Check and inline comments, live on install; scans run from the console on a chosen SHA |
| Unit of work | Issues and security hotspots against rules and gates; the Hunter Agent hunts logic flaws | Up to five findings per review, grounded on the added lines; scan findings come as leads with evidence |
| Complementary? | Yes | Yes |
SonarQube runs deep static analysis on branches and pull requests, enforces quality gates, and tracks quality and security across the codebase, with AI Code Assurance for code produced by coding agents and AI CodeFix for suggested repairs, per Sonar's site. Its Hunter Agent extends the platform with what Sonar calls an AI security agent that hunts logic flaws. Aevral is built for a reading of its own: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the change, and its whole-repo scan reads who has access to what: authorization, IDOR, and business-logic access control. Good code and safe access are separate properties; a change can read well while moving the other.
Sonar publishes logic flaws in the Hunter Agent's scope (their words: an AI security agent that hunts logic flaws), and its taint analysis reads data flow for injection classes; Aevral reads access control and business logic at rest, and a wider security class list on the pull request. With Aevral's PR review, live on install, both run on the same pull request; Aevral also reads the repository snapshot at rest as a whole-repo scan, for access control and business logic only. The framing stays complementary: each tool does the job it publishes, and this page makes no claim about results on your pull requests.
SonarQube
SonarQube is a code quality and security platform. It runs static analysis on branches and pull requests, enforces quality gates, assures AI-generated code with AI Code Assurance, and suggests fixes with AI CodeFix, per Sonar's site. Its SonarQube Hunter Agent, available on SonarQube Cloud Enterprise and announced for SonarQube Server in 2026-08, is what Sonar calls an AI security agent that hunts logic flaws.
Aevral
Security review, handled. PR review, live on install, looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks on the diff. Paid PR plans are live in the console. The whole-repo scan is live and self-serve, and reads authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a human decides. No patches are auto-applied.
This change flattens two guards into one because the export already writes an audit line for each call. The route passes the signed-in check, the log line appears, and the tests that exercise the happy path still pass.
export async function exportWorkspace(req, user) { assertRole(user, 'admin', req.workspaceId) assertSignedIn(user) return stream(await collect(req.workspaceId))The user is signed in, the audit line is written, and the export still streams. What changed is the check: the workspace-scoped admin assertion became a bare signed-in assertion, so any member who can name this workspace id can export its data. That is the Broken Function Level Authorization shape (OWASP API5:2023): the function is reachable by principals the check no longer binds to the workspace. Aevral is built to read a diff for the binding that left, not the audit line that stayed.
Keep SonarQube for the quality gate and the platform's security analysis; run Aevral for its security reading of the same pull requests and the access-control reading of the whole-repo snapshot, live on install.
No. SonarQube does its stated job and keeps doing it. Aevral runs alongside it with its own reading: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security on the pull requests it reviews, and its whole-repo scan reads access control and business logic across the repository at rest.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: SonarQube and Aevral on the works-alongside page.
See the wider field: SonarQube alternatives.
Primary sources: SonarQube; SonarQube AI Code Assurance; Announcing the SonarQube Hunter Agent; Aevral PR security review; Aevral whole-repo scan.
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.