[Guides]

How it works, in more than a sentence.

The landing pages sell the job. These pages do the job in detail: the surface, the mechanics, the artifacts, and the honest limits, with primary sources where primary sources exist.

Explainer2026-09-01
What a whole-repo authorization scan readsThe access-control surface of a repository, read the way a researcher reads it: routes, gates, tenant bindings, and the object references behind them.Read the guide
Explainer2026-09-01
PR security review and SAST are different questionsWhat a SAST pass and a diff-level access reading each do in a pipeline, where each fits, and why one answer cannot substitute for the other.Read the guide
Walkthrough2026-09-01
Handing a security finding to your coding agentThe fix prompt exists because the agent that reads code all day can fix what the scan found, once a human has seen the evidence.Read the guide
Explainer2026-09-01
The Aevral launch-updates list, explainedThe honest mechanics: the product is self-serve today, and the email list is an optional launch-updates channel that reserves nothing.Read the guide
Checklist2026-09-02
Reviewing a pull request for access controlThe procedure for the access surface of a diff: what to read first, four shapes worth stopping for, and the evidence that settles the question.Read the guide

Scan your whole repo for access bugs.

One GitHub App. A report with evidence. A prompt for the agent you already use.

Join waitlist