Security engineers
For security engineers outnumbered by repositories and pull requests. Aevral looks for security flaws on pull requests, live on install, and reads the whole repo for authorization, IDOR, and business-logic access control, handing you leads with evidence.
Security engineers are outnumbered. There are more repositories, more pull requests, and more merge buttons than there are hours, and the changes that matter most are the quiet ones: a dropped ownership check, a tenant binding that moves, a scope that widens to make a deploy pass. None of those look alarming in a diff view at midnight.
The leverage you need is a second reader that never tires and that reads for exactly the thing you would read for if you had the time: who has access to what.
Aevral goes through the default-branch snapshot of a repository the way a security researcher does: cross-file context, the authorization rules behind each route, the business logic that decides who may access what. The scan reads access control and business logic only; injection, XSS, SSRF, and the rest of the wider list are PR review's job, live on install, on the diff. It is not a general SAST and does not pretend memory corruption is its lane.
Every finding is a lead with evidence: the file, the lines, and the reason a human should look. You stay the judge. The goal is not to replace your judgment, it is to point your judgment at the changes that need it instead of at everything that arrives.
The kind of change it reads
A tenant selector moves off the session
IDOR
An admin gate goes from a role to a login
Widened gate
A client token lands with org-wide scope
Over-grant
Today Aevral's pull-request reviews read access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security; whole-repo scans read access control and business logic. Not memory corruption, not secret or dependency scanning, not a general SAST. A finding is a lead with evidence, and a human decides. PR review is live on install: installing the App starts reviews, and the owner can turn them off. Paid PR plans are live in the console.
Read next
The scan product; The PR security review product; How Aevral compares.
Also for
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.