Open-source maintainers
For maintainers reviewing pull requests from humans and agents alike. Aevral looks for security flaws on those pull requests, live on install. The public-repo lane is free.
Open-source maintainers review contributions from people they have never met, increasingly written by agents they cannot see. The contributions are usually fine. The ones that are not are usually quiet: a route that mounts without a guard, a client token with a wide scope, a check that becomes a prefix match.
The maintainer's real question on every pull request is the access question: what can this code do, and to whom.
Aevral reads a repository's default-branch snapshot for access control and business logic, on your trigger from the console. For authorized public repositories, the whole-repo scan is USD 0: one scan per calendar month. Public repositories get the free lane on purpose; maintainers should not need a budget to see the access-control surface of their own project.
On PR review, public repositories are free, 500 reviews per organization per month: a Check plus inline comments on the added lines, up to five findings per review, never blocking a merge. PR review is live on install: installing the App starts reviews on the next pull request, and the owner can turn them off. Paid PR plans are live in the console.
The kind of change it reads
A contributor route ships with no gate
Missing gate
A dependency client lands over-scoped
Over-grant
A helper widens an org check
Business logic
Today Aevral's pull-request reviews read access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security; whole-repo scans read access control and business logic. Not memory corruption, not secret or dependency scanning, not a general SAST. A finding is a lead with evidence, and a human decides. PR review is live on install: installing the App starts reviews, and the owner can turn them off. Paid PR plans are live in the console.
Read next
The scan product; Pricing (public repos are free); Works alongside your stack.
Also for
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.