What a scan looks like
The whole-repo scan: press Scan in the console, get a GitHub Check, a console report, and a suggested fix.
The whole-repo scan is the first Aevral product. One scan covers your repository's default branch: cross-file context, authorization rules, the business logic behind who has access to what.
How a scan runs
- Trigger. You press Scan in the Aevral console. Aevral scans at rest, on your trigger. Not on every push.
- Read. The scan goes through the default-branch snapshot of the repository, following authorization logic across files.
- Report. You get a GitHub Check on the scanned commit plus the full report in the console. Each finding carries its evidence: the code paths and rules behind it.
- Suggested fix. Each finding comes with a suggested fix you apply in Claude Code, Cursor, or Codex. Nothing merges without you.
Review every finding before you change production code. A scan is not a clean bill of health.
What the scan reads
Today the scan reads:
- Authorization: who has access to what, enforced where, missed where.
- IDOR: object-level access checks that are missing or wrong.
- Business-logic access control: rules the code intends but does not enforce.
The scan does not read injection, XSS, SSRF, path traversal, deserialization, token and session flaws, or LLM-integration risks. Those classes are covered by pull-request reviews, on the diff only.
Not memory corruption. Not secrets, dependencies, or supply chain. Not a general SAST. If you need those classes today, keep the tools that do them: Works alongside.
What you get
| Surface | What it carries |
|---|---|
| GitHub Check | The scan outcome on the scanned commit, with a link to the report |
| Console report | Every finding with its evidence and the affected code paths |
| Findings worklist | Remembered findings across scans for that repository, with a human archive (the findings worklist). |
| Suggested fix | A prompt you apply in Claude Code, Cursor, or Codex. Nothing is applied without you. Aevral does not commit or open pull requests. |
Plans
Scan plans, USD per organization, HT B2B, excluding VAT:
- Public repositories: $0. 1 authorized public-repo scan per calendar month. Public repositories here means authorized public repositories, not that the Aevral service is open source. Authorization is required to scan; findings are not auto-published.
- Team: $99 / org / month. 4 default-branch scans per month, then $29 per extra scan.
- Business: $399 / org / month. 16 default-branch scans per month, then $19 per extra scan.
- Scale: $1,699 / org / month. 100 default-branch scans per month, then $17 per extra scan.
- Enterprise: get in touch.
How the scan reaches its findings, in prose: How Aevral hunts.
Full details and the PR review ladder (free tier live from install; paid plans live in the console): Pricing and plans. The canonical marketing source is aevral.com/pricing.
Start
Install the GitHub App, then sign in to the console with GitHub; it connects the install automatically. Free organizations get two private scans in 14 days; paid first scans use the included scan allowance.