GitHub App
One App carries both products: the whole-repo scan at rest, and the PR security review, live on install.
Open. Install the App.
Install the GitHub App when your repositories live on GitHub. It is the only install: the console, where you sign in with GitHub after, is where you trigger scans and read reports.
The App is public. Install it on the repositories you pick, the same way any GitHub App install works.
For the whole-repo scan, the App asks for Contents read, Metadata, and Checks write. Nothing more for this product. You pick the repositories, the same way any GitHub App install works, and scans run from the console or an enabled recurring schedule on a paid scan plan, not on every push.
PR review rides the same App, live on install: your organization accepts Pull-requests read and write, and installing the App starts reviews. Setup Complete can turn them off. An opt-out stays off while the App stays installed; reinstalling the App turns reviews back on. Then Aevral posts an advisory Check plus inline comments grounded on the added lines. It never blocks a merge. Paid PR plans are live in the console.
What the scan reads
A tenant selector moves off the session
IDOR
An admin gate goes from a role to a login
Widened gate
A client token lands with org-wide scope
Over-grant
Today Aevral's pull-request reviews look for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security; whole-repo scans read authorization, IDOR, and business-logic access control. Not memory corruption, not secret or dependency scanning, not a general SAST.
Read next
The scan product; The PR security review product; Pricing (both SKUs); How Aevral compares; FAQ.
The other surface
Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.
For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.