How it works, in more than a sentence.

The landing pages sell the job. These pages do the job in detail: the surface, the mechanics, the artifacts, and the honest limits, with primary sources where primary sources exist.

Explainer2026-09-01
What a whole-repo authorization scan readsThe access-control surface of a repository, read the way a researcher reads it: routes, gates, tenant bindings, and the object references behind them.Read the guide
Explainer2026-09-01
PR security review and SAST are different questionsWhat a SAST pass and a diff-level access reading each do in a pipeline, where each fits, and why one answer cannot substitute for the other.Read the guide
Walkthrough2026-09-01
Handing a security finding to your coding agentThe fix prompt exists because the agent that reads code all day can fix what the scan found, once a human has seen the evidence.Read the guide
Explainer2026-09-01
The Aevral launch-updates list, explainedThe honest mechanics: the product is self-serve today, and the email list is an optional launch-updates channel that reserves nothing.Read the guide
Checklist2026-09-02
Reviewing a pull request for access controlThe procedure for the access surface of a diff: what to read first, four shapes worth stopping for, and the evidence that settles the question.Read the guide
Walkthrough2026-09-14
Working a scan report of access-control leadsThe scan hands you a list of leads, not a queue of patches to merge. This page is how to spend that list: which leads to open first, which three questions close one, and when to hand a lead to your coding agent.Read the guide
Deep dive2026-09-18
How IDOR happens in multi-tenant codeThe object-level bug is one fact wide: the caller names the record and the query trusts it. One screen of code, why the tests pass anyway, and the shape of the fix.Read the guide
Explainer2026-09-27
Where access control hides in business logicSome access rules are not middleware or query scope: they are encoded in the feature logic itself. What that class looks like, why a per-line read does not see it, and how to read it.Read the guide
Checklist2026-09-29
Reviewing a pull request that wires in an LLMThe LLM-integration class of the PR review: what the diff of an AI feature touches, four shapes worth stopping for, and the primary sources behind each.Read the guide
Explainer2026-09-30
Security review priced per pull request, explainedAevral prices its PR security review per organization, as a monthly allowance of pull-request reviews. On paid plans one pull request counts once per billing period, however often it is re-pushed. The free tier needs no card.Read the guide
Walkthrough2026-09-30
Reviewing pull requests for IDOR with a GitHub appInstall the Aevral GitHub App on a repository and it looks for IDOR and broken access control on each supported pull request, live on install: an advisory Check, and inline comments with a suggested fix when there is a grounded finding. No workflow file, no CLI.Read the guide
Worked example2026-09-30
Spotting a missing tenant check in a pull requestThe tell is a new handler that loads a record by id and never asks which organization it belongs to, while its neighbors in the same file do. One diff, the question that settles it, and the one-line fix.Read the guide
Checklist2026-09-30
Next.js and Supabase: the authorization check before launchBefore launch, check four places: Row Level Security on every table the browser can reach, policies that scope by organization, every use of the secret key, and an authorization check inside each server action and route handler. A worked example of the most common gap.Read the guide
Explainer2026-10-01
Security review for pull requests written by Claude CodeClaude Code writes the change in your terminal, and the pull request it becomes can open with no session attached. This page is who reads it for security: Claude Code's own review modes, your own checklist, and a second reviewer installed on the repository.Read the guide
Explainer2026-10-01
Vibe coding security: who reads the diffVibe coding is AI-assisted shipping where you read less of what got written, and it is on its way to being called just coding. This page is the security question that stays, and the review that answers it on every supported pull request.Read the guide
Explainer2026-10-01
Why review bots get ignored, and what a grounded review does insteadThe three habits that train engineers to mute a security bot, and the mechanical rules a review needs before it is allowed to speak.Read the guide
Explainer2026-10-03
Security review for pull requests written by CursorCursor can open the pull request, and Bugbot may already have commented. This page is the security read of that diff: what Bugbot's own docs say it does, and a second reviewer that stays a suggestion.Read the guide
Explainer2026-10-03
Security review for pull requests written by CodexCodex can open the pull request. The Codex Security page says engineering teams find, confirm, and fix vulnerabilities. This page is the read that stays a suggestion.Read the guide

Security review, handled.

Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.

Install the GitHub App Log in Sign up

For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.