What a PR review looks like
The PR security review as it runs today (free tier, per-organization opt-in): an advisory Check plus inline comments on added lines, max two findings, silence when clean.
Claiming a new organization starts PR reviews on. Setup Complete can still turn them off. Existing opt-outs stay off. Free includes 25 private reviews per month after the trial, and paid plans are live in the console.
The PR security review is an opt-in add-on SKU inside Aevral. It is not one of the included whole-repo scans and not a replacement for the scan plans. USD per organization, B2B; paid plans are live in the console.
How a review runs
- Trigger. Pull requests opened, reopened, and synchronized in an opted-in organization. Each new head is a fresh review; the same head is never billed twice.
- Read. The diff of the pull request is read, plus up to 40 changed files at head, hunting authorization, IDOR, and business-logic access control flaws.
- Post. An advisory Check on the head commit plus inline comments pinned to the exact added lines. Never blocks a merge.
- Bound. Hard max two findings per review. Silence when there is nothing to publish.
Grounded on added lines
Every inline comment is pinned to a line the pull request actually added, on a file the pull request actually touched. If the evidence cannot be grounded, the comment does not post. Oversized pull requests get a neutral note, not a partial review sold as complete.
Plans
Free tier: public repositories are always free, and private repositories get 25 pull-request reviews a month free. A 14-day private trial with a 500-review cap starts with the first reviewed pull request after opt-in, no card. Paid plans are purchasable in the console.
PR security review plans, USD per organization per month (paid plans live in the console):
| Plan | Price | Included private reviews | Past included |
|---|---|---|---|
| Free | $0 | 25 private pull-request reviews per month | Subscribe in the console, or wait for the next month. |
| Starter | $19 | 100 included private reviews | $0.49 per extra review, opt-in only |
| Pro | $99 | 500 included private reviews | $0.49 per extra review, opt-in only |
| Business | $249 | 2000 included private reviews | $0.49 per extra review, opt-in only |
Paid plans stop at their included allowance by default. An owner must explicitly authorize $0.49 excess private reviews. Failed or skipped reviews release their reservations; a new head commit is a new review, while replaying the same head does not count twice. Public reviews remain free. Scan and PR allowances are separate.
Permissions note
The scan product needs Contents read, Metadata, Checks write. The PR security review adds Pull requests read and write, accepted by your organization at install. Claiming a new organization starts reviews on; Setup Complete or the Reviews page can turn them off. See GitHub App permissions.
Start
Install the GitHub App, log in to the console, and claim the install (new organizations start with PR reviews on), or enable them later from Reviews. The whole-repo scan is a separate product with its own price: What a scan looks like.