What a scan looks like
The whole-repo scan: press Scan in the console, a researcher reads the default-branch snapshot, you get a GitHub Check, a console report, and a fix prompt. No patches.
The whole-repo scan is the first Aevral product. One scan covers your repository's default branch: cross-file context, authorization rules, the business logic behind who has access to what.
How a scan runs
- Trigger. You press Scan in the Aevral console. Aevral scans at rest, on your trigger. Not on every push.
- Read. The scan goes through the default-branch snapshot of the repository the way a human security researcher would, following authorization logic across files.
- Report. You get a GitHub Check on the scanned commit plus the full report in the console. Each finding carries its evidence: the code paths and rules behind it.
- Hand off. Each finding comes with a fix prompt you can copy into Claude Code, Cursor, or Codex. A human reviews before merge.
A finding is a lead, not a confirmation. A scan is not a clean bill of health.
What the scan reads
Today Aevral scans:
- Authorization: who has access to what, enforced where, missed where.
- IDOR: object-level access checks that are missing or wrong.
- Business-logic access control: rules the code intends but does not enforce.
Not memory corruption. Not injection. Not a general SAST. If you need those classes, keep the tools that do them: Aevral works alongside them, see Works alongside.
What you get
| Surface | What it carries |
|---|---|
| GitHub Check | The scan outcome on the scanned commit, with a link to the report |
| Console report | Every finding with its evidence and the affected code paths |
| Findings worklist | Remembered leads across scans for that repository, with a human archive. Not enabled in production yet. The findings worklist |
| Fix prompt | Copy into Claude Code, Cursor, or Codex; a human reviews before merge |
Aevral does not generate patches, does not commit, and does not open pull requests.
Plans
Scan plans, EUR per organization, HT B2B, excluding VAT:
- Open source: €0. 1 authorized public-repo scan per calendar month. Open source here means authorized public repositories, not that the Aevral service is open source. Authorization is required to scan; findings are not auto-published.
- Team: €99 / org / month. 4 default-branch scans per month, then €29 per extra scan.
- Business: €399 / org / month. 16 default-branch scans per month, then €19 per extra scan.
- Scale: €1,699 / org / month. 100 default-branch scans per month, then €17 per extra scan.
- Enterprise: get in touch.
Full details and the PR review add-on ladder (free tier live via per-organization opt-in; paid plans live in the console): Pricing and plans. The canonical marketing source is aevral.com/pricing.
Start
Install the GitHub App, log in to the console, and claim your install. Free organizations can use one lifetime private baseline when available; paid first scans use the included scan allowance.