Aevral

A security agent for your code.

Scan the repository. Review pull requests. Suggested fixes. Open-source models, hosted in the US or the EU. An alternative to Claude Security and Codex Security. Log in to start.

Log inby ISMS Copilot
GitHub AppOpen-source modelsSuggested fixes

Scan the repo. Review the pull request.

Review the pull request.

An advisory GitHub Check on supported pull requests, and comments when there is a finding.

Owner or admin authorization required. Claiming a new organization enables reviews; installing alone does not. Existing opt-outs stay off. You can disable reviews at any time.

Explore PR review

What a scan reads

  1. Missing authorization on a routeauthorization
  2. IDOR on an object idIDOR
  3. Cross-tenant readIDOR
  4. Cross-tenant writeIDOR
  5. Caller-named tenant idIDOR
  6. Business-logic bypasslogic
  7. Gate assumed by the handlerauthorization
  8. Prefix match on an org idlogic
  9. Admin route without a role checkauthorization
  10. Debug route left mountedauthorization
The whole guide

What a finding looks like.

Four illustrative findings, each played back to the line it points at: the code, the class, the explanation and the fix-prompt link. Example playback on example code, not a live scan.

api/orders/[id]/route.tsexample playback/reading
  1. 14export async function GET(req, { params }) {
  2. 15 const order = await db.order.findById(params.id)
  3. 16 return Response.json(order) // no owner check
  4. 17}
AevralHighbroken access controlexploitable
See the fix prompt

GET /orders/:id returns any order by id. No check that the record belongs to the caller's org, reachable from an unprivileged session.

example route.ts:16 on main

Example finding

How it works.

Claude Code · Cursor · Codex

  1. Scan

    Scan the code already in the repository.

  2. Review

    Review pull requests for security issues.

  3. Suggest a fix

    A suggested fix for each finding. Apply it in Claude Code, Cursor, or Codex.

The scope, in plain terms.

Aevral is an alternative to Claude Security and Codex Security. Open-source models, hosted in the US or the EU. Read the transparency report. Compare Claude Security and Codex Security.

Coverage
Today Aevral scans authorization, IDOR, and business-logic access control. Not memory corruption, not injection, not a general SAST.
Pricing
Per organization and usage, never per seat. Scan: authorized public repos, one scan a month at €0; Team €99 / month includes 4 default-branch scans, then €29 per additional scan. PR review: 25 private reviews a month free; paid plans from $19 / org / month. No scan plan required. Excluding VAT.
All plans ↗
Models
Open-source models. Hosted in the US or the EU.
Your decision
A suggested fix is yours to apply. Nothing merges without you.

A security agent for your code.

Install the GitHub App, claim your organization. Press Scan for the default branch. New organizations start with PR review on; existing opt-outs stay off.

Log in