GitHub App permissions
What the Aevral GitHub App requests, why each permission exists, and what it never gets. The App is public and installable on any account.
The Aevral GitHub App (name: aevral) is public: install it on any account or organization from https://github.com/apps/aevral. This page documents the permission set so you can review it before you install.
Scan product permissions
| Permission | Level | Why |
|---|---|---|
| Contents | Read | Read the default-branch snapshot the scan analyzes |
| Metadata | Read | Repository and organization structure (mandatory GitHub permission) |
| Checks | Write | Post the scan Check on the scanned commit |
That is the full set for the scan product. Nothing more.
PR security review permissions
The PR security review is live as a free tier (per-organization opt-in) and adds:
| Permission | Level | Why |
|---|---|---|
| Pull requests | Read and write | Read the diff and post the advisory Check and inline comments |
Your organization accepts that permission at install. Claiming a new organization starts PR reviews on (the same default as the Setup checkbox). Installing the App without claiming does not process reviews. Setup Complete can still turn them off. Reconnecting an organization that opted out stays off. Reviews can also be managed from the Reviews page. Paid PR plans are live in the console.
What the App never gets
- No write access to your code. No push, no commit, no branch creation. The scan product reads contents and posts a Check.
- No user, secret, or deployment permissions.
- No access to repositories you did not authorize. Scans run on repos you explicitly authorized, on your trigger. Authorization is required to scan.
What this means for review
- A Check lands on the scanned commit (and, with the opt-in PR review, on the head commit of reviewed pull requests).
- The Check never blocks a merge.
- Findings stay in your console and your Checks; findings are not auto-published.
Related: What a scan looks like, Security and data.