For maintainers reviewing pull requests from humans and agents alike. Aevral reads the access-control surface of your repo, and the public-repo lane is free. With its opt-in PR review, it reads the pull requests too.
Open-source maintainers review contributions from people they have never met, increasingly written by agents they cannot see. The contributions are usually fine. The ones that are not are usually quiet: a route that mounts without a guard, a client token with a wide scope, a check that becomes a prefix match.
The maintainer's real question on every pull request is the access question: what can this code do, and to whom.
Aevral reads a repository's default-branch snapshot for authorization, IDOR, and business-logic access control, on your trigger from the console. For authorized public repositories, the whole-repo scan is EUR 0: one scan per calendar month. Public repositories get the free lane on purpose; maintainers should not need a budget to see the access-control surface of their own project.
On PR review, public repositories are always free too: a Check plus inline comments on the added lines of every pull request, up to two findings per review, never blocking a merge. PR review is live and opt-in per organization; paid PR plans are live in the console.
The kind of change it reads
A contributor route ships with no gate
Missing gate
A dependency client lands over-scoped
Over-grant
A helper widens an org check
Business logic
Today Aevral scans authorization, IDOR, and business-logic access control. Not memory corruption, not injection, not a general SAST. A finding is a lead with evidence, and a human decides. PR review is live as an opt-in add-on per organization; paid PR plans are coming soon.
Read next
The scan product; Pricing (public repos are free); Works alongside your stack.
Also for
One GitHub App. A report with evidence. A prompt for the agent you already use.