FAQ

Does Aevral block merges?

No. The GitHub Check from a scan reports the outcome on the scanned commit; it never blocks a merge. PR review is live today as a free tier (25 private reviews per month). Claiming a new organization starts reviews on; Setup Complete or the Reviews page can turn them off. Its Check is advisory and its inline comments never block a merge either.

What does Aevral look for?

Today: authorization (who has access to what, enforced where, missed where), IDOR (object-level access checks that are missing or wrong), and business-logic access control (rules the code intends but does not enforce). Not memory corruption, not injection, not a general SAST. A finding is a lead with its evidence, not a confirmation; there is no patch generation, only a fix prompt you hand to Claude Code, Cursor, or Codex with a human review before merge.

Details: What a scan looks like. Across scans, the findings worklist keeps those leads and a human archive. A later scan that omits a lead does not mean it is fixed.

How do I get access?

Aevral is self-serve: install the GitHub App, log in to the console, and claim your install. Free organizations can use one lifetime private baseline when available; paid first scans use the included scan allowance. Questions or procurement: contact form.

What does it cost?

Whole-repo scan plans in EUR per organization per month: Open source €0 (1 authorized public-repo scan per calendar month), Team €99 (4 default-branch scans, then €29), Business €399 (16, then €19), Enterprise get in touch. The PR security review is a USD add-on: Free $0 (25 private reviews per month, live today; new claims start reviews on), Starter $19 (100, then $0.49), Pro $99 (500, then $0.49), Business $249 (2000, then $0.49; paid plans live in the console). Whole-repo scan plans also gained the Scale rung: EUR 1,699 (100 scans, then EUR 17). All prices exclude VAT, B2B. Full tables: Pricing and plans.

Is the GitHub App public?

Yes. The App is public: install it on any account or organization from https://github.com/apps/aevral. Scan permissions are Contents read, Metadata, Checks write; the opt-in PR review adds Pull requests read and write: GitHub App permissions.

Who is behind Aevral?

Aevral is a Better ISMS product, by ISMS Copilot. Security and legal corpus: trust center, privacy: privacy policy.

What is not live yet?

A fully documented public API contract (keys exist today on the console Developer API page), and an MCP endpoint. Everything future-tense on this site stays future-tense until it ships. Paid PR plans and the findings worklist are live in the console.

Do I need to return every week?

PR reviews run automatically after a new organization is claimed. Setup Complete or the Reviews page can turn them off. Paid scan plans also support up to four automatic checkpoints per configured repository each billing month, sharing the included scan quota. They do not incur overage; unchanged commits reuse the report within the billing period and exhausted quota waits for renewal. This is not a free weekly private scan plan. See Recurring scans and quota.