For teams where agents write most of the diff. The merge button no longer waits for a human who has read the access rules. Aevral reads what shipped for who has access to what.
Teams shipping agent-written code merged a feature before lunch and a refactor after it, and the review that matters, the one asking whether the new code respects who may access what, is the review nobody has time to run on every pull request.
Velocity is not the problem. The problem is that access-control review does not scale with merge rate when every reviewer is also a human with a queue.
Aevral is built to be that reading at volume: the whole repository at rest, on your trigger from the console, with a GitHub Check on the scanned commit and a report where every finding carries its evidence. A finding is a lead, not a confirmation, and a human reviews each finding before merge, which is the rule your team already runs on.
With the opt-in PR review add-on, the same reading runs on every pull request, opened, reopened, and synchronized: an advisory Check plus inline comments on the added lines, hard max two findings per review, never blocking a merge. It fits teams that want a signal, not a gate.
The kind of change it reads
A refactor drops an ownership check
Authorization
A new endpoint returns every row
Missing gate
A project transfer skips the target-org membership check
Authorization
Today Aevral scans authorization, IDOR, and business-logic access control. Not memory corruption, not injection, not a general SAST. A finding is a lead with evidence, and a human decides. PR review is live as an opt-in add-on per organization; paid PR plans are coming soon.
Read next
The scan product; The PR security review product; Pricing for both SKUs.
Also for
One GitHub App. A report with evidence. A prompt for the agent you already use.