Security and data
Short operational pointer: what Aevral reads from and posts to your repositories. The canonical security page is aevral.com/security; the DPA section 1.7 and the Aevral sub-processor page are binding.
Aevral reads your code through the Aevral GitHub App, with a short-lived token minted per job and limited to one repository. Pull request reviews start when the App is installed on the repositories you select, and read the diff plus some changed files in full at the head commit. Scans read one archive of a repository you selected, at a single commit. On GitHub, Aevral posts only advisory Checks and pull request review comments; it does not commit, push, create branches, merge or approve, and suggested fixes are text you apply yourself. Setup or the Reviews page can turn reviews off. Permission detail: GitHub App permissions.
Where the security detail lives
- Canonical security page: aevral.com/security. Tokens, write actions, webhooks, code processing, model path, data storage, retention, what is announced and what we do not have yet. It is generated from the same manifest the engine is tested against.
- Binding: the Data Processing Agreement, section 1.7 (Aevral) and the Aevral sub-processor page. If anything on this site reads differently, those documents win.
- United States buyers: the DPA carries a United States State Privacy Laws section with the service-provider terms for California (CCPA/CPRA) and comparable state laws, and the US buyers page gathers what a US purchase process asks for.
- Where code is processed: model inference runs in the US today. An EU-only processing option is announced, not live. Current state: aevral.com/security.
- Privacy: privacy policy.
Report a security issue
Follow the vulnerability disclosure policy. Contact details are also in security.txt.
Other questions: contact form.