Changelog

What has shipped in Aevral. Prices and plan tables stay on Pricing and plans.

October 2026

Features

• Review activity page. aevral.com/live shows aggregate, rounded numbers of completed pull-request reviews, updated daily and at least 24 hours delayed: the running total, the last 7 days, finding severities in public-repo reviews, and a 14-day digest. Counts include reviews across all workspaces, including our own; each completed pull-request version is counted once; rounded lower bounds; days below the publication threshold are labeled as such. No repository, organization, or personal data is published (review activity). The homepage carries the same number as a quiet strip.

Improvements

• US state privacy law terms. The Data Processing Agreement that covers Aevral now has a United States State Privacy Laws section: for the content your organization authorizes, Aevral acts as a service provider under the CCPA/CPRA and comparable state laws, never sells or shares personal information, and no opt-out signal changes anything (DPA). US buyers: the paperwork a US purchase process asks for is gathered on aevral.com/us-buyers.

• More pull request reviews per plan, and a Scale plan. New subscriptions get more reviews on each plan: Starter 100, Pro 500, Business 3,000, and the new Scale plan 6,500 a month. Business and Scale include the monthly export of review results. Extras stay at $0.99 per pull request, only if the owner turns them on. Existing subscriptions keep their price (pricing and plans).

• New pull request review plans. Organizations that subscribe now choose Starter, Pro, or Business at the new prices, billed monthly, and Business adds a monthly export of the security reviews Aevral ran on your pull requests as supporting audit evidence. Existing subscriptions keep their plan (pricing and plans).

• Pull request reviews read every changed file. Aevral now reads the diff of each changed file first, and the most security-relevant files in full. Generated files, lockfiles, and translation data are skipped and named in the Check (what a PR review looks like).

• Up to five findings per review. A review can post up to five findings and says how many more it held back.

• Unverified leads in the Check. Likely issues Aevral could not prove are listed in the Check under "Unverified, worth a look", never as pull request comments.

• Ask for a full review. Comment @aevral review on a pull request to have Aevral review the whole pull request again; the Check shows when it ran (GitHub App permissions).

• Choose when Aevral reviews. Each organization or repository can review every push, once per pull request, or only on request; for private repositories on paid plans, after 20 automatic reviews of one pull request in a billing period, later pushes are reviewed on request.

• A documented API for scans and usage. Organizations mint aevr_ keys from the console Developer API page (shown once), start and read whole-repo scans, and read plan and usage with the same key (Scan API, Usage API, Console and API keys).

Fixes

• Multi-line findings no longer dropped. Findings that quote several lines of changed code, or a removed security check, now post instead of being discarded.
• Honest coverage note. The Check lists only files Aevral actually read, and says why any file was not read (size limit, model call failed, sensitive path, or excluded by rule).

September 2026

Features

• Pull request reviews. Aevral posts an advisory GitHub Check on pull requests, with 500 free public reviews per organization each month, 25 free private reviews a month, and a 14-day private trial with up to 500 private reviews (one per GitHub account) before a paid plan.
• Repository scans. A scan reads authorization, IDOR, and business-logic access on a repository you choose, with two private scans in 14 days before a paid plan.
• Findings worklist. The console keeps scan findings for each repository, with history and a human archive (the findings worklist).
• Suggested fixes. A finding can include a fix you copy into Claude Code, Cursor, or Codex, and Aevral never applies or merges it.
• Fix with your agent on pull requests. Each inline pull request finding now ends with a paste-ready prompt for Claude Code, Cursor, or Codex (what a PR review looks like).
• Onboard your coding agent. Setup can copy a prompt your coding agent fetches, and you still install the GitHub App and sign in yourself.

Improvements

• Advisory wording on pull requests. Pull request comments and Checks no longer say "confirmed": a finding is a lead, and Checks read "N findings (advisory)" or "No findings".
• Billing has two tabs. Billing opens on pull request reviews, with a separate Scans tab, and each tab shows one plan and one usage meter.
• System, light, and dark. The console follows your system appearance, and the sidebar can switch System, Light, or Dark.
• Google and Microsoft sign-in. Login offers Google and Microsoft beside GitHub.

Fixes

• Google mark. The Google button uses the four-color G with no white tile.