Automatic pull request reviews look for security flaws across access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security. Aevral reads the diff of each supported pull request, and the most security-relevant changed files in full.
It posts an advisory Check on the head commit and inline comments pinned to the exact added lines. The Check still reports when there are no comments.
On a large pull request, the most security-relevant files are reviewed first, and the review says which files it covered. Never blocks a merge. You apply the suggested fix.
How it runs
The same Aevral GitHub App. Reviews start at install. The owner can turn them off.
Pull requests opened, reopened, and synchronized. After the first review of a pull request, a re-push reviews only what changed since the last reviewed commit; a force-push, a rebase or a reopen gets a full review again.
On paid plans, a pull request counts as one PR review per billing period, however often it is re-pushed; on Free and the trial, each new head is a new review and the same head is never counted twice.
An advisory Check plus inline comments on the hunks, grounded on added lines. On a re-push, a new review is posted only when there are new findings; the summary review is edited in place. Never blocks a merge.
Looks for access control, business logic, injection, XSS, SSRF, path traversal, deserialization, session flaws, and LLM-integration risks. Up to five findings per review.
A separate product: a review is never one of the included whole-repo scans of a scan plan, and no scan plan is required.
What it looks for
What it costs today
Free
Try it on your repositories
$0
25 private reviews a month
Public repositories free, 500 reviews a month
Starter
A founder shipping with agents
$49/ month
100 PR reviews a month
then $0.99 a review, only if you turn extras on
Pro
A team with several agents
$199/ month
500 PR reviews a month
then $0.99 a review, only if you turn extras on
Business
Teams that answer to auditors
$999/ month
3,000 PR reviews a month
then $0.99 a review, only if you turn extras on
No surprise bill. On a paid plan, the first time you go over you get 25% more reviews free, once. After that, reviews pause unless you turn on extras, which stop at a monthly cap you set. Free has no extras.
Priced per organization, never per seat. No scan plan required. Full pricing terms
Grounding, not spray
The access-control and business-logic part of that reading, at rest, is a separate product: the whole-repo scan, manual or recurring on a paid scan plan, with its own allowance. See the scan product.
For the audit angle, what to show an ISO 27001 auditor and where the record lives on each pull request: the audit evidence page.
One GitHub App. Reviews start when the App is installed. A Check on each pull request it reviews, with inline comments when there is a grounded finding. Free tier live: public repos free, 500/org/month, 25 private reviews a month. Paid plans are live in the console.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.