ZeroPath scans repositories and reviews pull requests across a broad AppSec stack; Aevral adds a reading focused on the authorization and business-logic questions: a live opt-in PR review on the pull request, and a whole-repo scan at rest.
| Row | ZeroPath | Aevral |
|---|---|---|
| Question it answers | What vulnerabilities does the code contain, across patterns and logic? | Who has access to what, and does this change widen it? |
| Stated job | AI-native SAST with business-logic and broken-authentication detection, plus SCA, secrets, IaC, DAST, pull-request reviews with one-click autofix, per ZeroPath's pricing page | Authorization, IDOR, and business-logic reading of the PR diff, and of the whole-repo snapshot at rest |
| Where it runs | ZeroPath cloud; Enterprise on-prem, self-hosted, or private cloud; GitHub, GitLab, Bitbucket, and Azure DevOps, per ZeroPath's pricing page | GitHub Check and inline comments, opt-in per organization; scans run from the console on a chosen SHA |
| Unit of work | Validated findings with prioritization and one-click autofix; Team from USD 1,000/mo plus USD 60/dev, per ZeroPath's pricing page | Up to two findings per opt-in review, grounded on the added lines; scan findings come as leads with evidence |
| Complementary? | Yes | Yes |
ZeroPath describes its platform as AI-native SAST with business-logic and broken-authentication detection, plus SCA with reachability, secrets, IaC, dynamic testing, pull-request reviews with one-click autofix, and runtime validation for exploitable findings, per ZeroPath's pricing page. Its Team plan starts at USD 1,000 per month plus USD 60 per developer with unlimited repositories and scans. Aevral is built for a reading of its own: does a change widen who has access to what, an authorization, IDOR, or business-logic access-control issue. Good code and safe access are separate properties; a change can read well while moving the other.
ZeroPath publishes business-logic and broken-authentication detection and pull-request reviews; Aevral's single job is the access reading, at rest and on the pull request. With Aevral's PR review, live and opt-in, both run on the same pull request; Aevral also reads the repository snapshot at rest as a whole-repo scan. ZeroPath's docs describe one-click autofix; Aevral does not patch: the fix is a prompt you hand to the coding agent you already use. The framing stays complementary: each tool does the job it publishes, and this page makes no claim about results on your pull requests.
ZeroPath
ZeroPath is an AI-native application security platform. Its published stack spans SAST with business-logic and broken-authentication detection, SCA with reachability analysis, secrets, IaC, and dynamic testing, with pull-request reviews, one-click autofix, runtime validation for exploitable findings, and scheduled or CI/CD scans, per ZeroPath's pricing page. Its Team plan starts at USD 1,000 per month plus USD 60 per developer with unlimited repositories; Enterprise adds on-prem, self-hosted, and private-cloud deployment with BYOK.
Aevral
Aevral is a security researcher for your code, built to read authorization, IDOR, and business-logic access control with cross-file context. The whole-repo scan is live and self-serve; PR review is live and opt-in per organization; paid PR plans are live in the console. A finding is a lead with evidence, and a human decides.
This change simplifies the support tooling's impersonation flow because the console already gates the page. The route returns the session, the audit line is written, and the tests that impersonate seeded users still pass.
export async function impersonate(req: Request, session) { assertAdmin(session); requireSameOrg(session, req.body.userId) assertSignedIn(session) return startSessionAs(req.body.userId)The user is signed in, the session starts, and the audit line is written. What changed is the check: the admin and same-organization assertions became a bare signed-in assertion, so any signed-in user of the tooling who can name another user's id starts a session as that user. That is the Broken Function Level Authorization shape (OWASP API5:2023): the privileged function is reachable by principals the check no longer binds. Aevral is built to read a diff for the binding that left, not the audit line that stayed.
Keep ZeroPath for its platform scanning and autofix; run Aevral for the authorization and business-logic reading of the same pull requests and the whole-repo snapshot, opt-in per organization.
No. ZeroPath does its stated job and keeps doing it. Aevral runs alongside it with its own reading: authorization, IDOR, and business-logic access control across the repository, and across every pull request through its opt-in PR review.
No. This page states each product's job and shows one worked example of Aevral's own reading. Results on your code depend on your code; evaluations belong to you.
Aevral is self-serve: install the GitHub App and log in to the console. The waitlist form is a launch-updates channel; joining does not reserve a price, access, or a contract.
More comparisons
The shorter version, at a glance: ZeroPath and Aevral on the works-alongside page.
Primary sources: ZeroPath pricing; ZeroPath; Aevral PR security review; Aevral whole-repo scan.
One GitHub App. A report with evidence. A prompt for the agent you already use.