# Aevral Docs - full content (English) Source: https://docs.aevral.com Prefer per-page .md URLs or this dump over scraping HTML. Aevral is self-serve: install https://github.com/apps/aevral and log in to the console. --- ## Console and API keys URL: https://docs.aevral.com/docs/console-and-api-keys Markdown: https://docs.aevral.com/docs/console-and-api-keys.md The Aevral console is where you claim your install, press Scan, read reports, enable PR review per organization, and manage billing and Developer API keys. Self-serve is live. Aevral is self-serve: install the [GitHub App](https://github.com/apps/aevral), [log in to the console](https://app.aevral.com/login) with your GitHub account, and claim your install. Free organizations can use one lifetime private baseline when available; paid first scans use the included scan allowance. ## What the console is for The console is the operating surface of the scan product: - **Authorize repositories** you want scanned. - **Press Scan.** Scans run at rest, on your trigger, against the default branch. - **Read reports.** Every finding with its evidence, plus the GitHub Check on the scanned commit. - **Copy fix prompts** for Claude Code, Cursor, or Codex. - **Enable PR review** per organization from the Reviews page (owner or admin; terms shown there). - **Manage billing** (subscribe, spend cap, plan change) and mint **Developer API keys**. Sign in at [app.aevral.com/login](https://app.aevral.com/login) with your GitHub account. ## How access works 1. Install the GitHub App on your account or organization: https://github.com/apps/aevral. 2. Log in to the console with your GitHub account and claim your install. 3. Complete Setup to pick the first scan, or to turn PR reviews off. Claiming a new organization already starts reviews on. Free private baseline eligibility is shown there; paid first scans use included quota. Read reports and manage recurring paid scans from the console. The full order is on [Set up with your agent](/docs/setup-with-an-agent). ## API keys (Developer API) Aevral API keys use the `aevr_` prefix and exist today. Mint one from the console **Developer API** page. Keys are shown once at creation: copy them immediately, and mint a fresh one if a key is ever lost. What a key can do today: - Start a scan on a repository your organization has authorized (the console itself uses the same endpoint). - Read scan status for your organization. What a key cannot do: - **Billing is console-only.** Checkout, plan changes, and the spend cap run on your authenticated console session and require owner or admin role; an `aevr_` key is rejected on billing routes. - A key never crosses organizations. It acts only for the organization it was minted under. The fuller public API contract is coming. Until it is documented, do not invent endpoints beyond what the console uses. The only other public API on this docs host is the docs search surface: [/api/agent-search](/docs/for-ai-agents), documented in [openapi.json](https://docs.aevral.com/openapi.json). It indexes documentation only, needs no key, and cannot touch an organization. ## What the console is not - Not a patch generator: findings come with a fix prompt you hand to your coding agent. Plans and terms are on [Pricing and plans](/docs/pricing-and-plans). - Not a continuous-integration server: scans are at rest, on your trigger. - Not the GitHub App install surface: installs happen on github.com/apps/aevral. See [GitHub App permissions](/docs/github-app-permissions). --- ## FAQ URL: https://docs.aevral.com/docs/faq Markdown: https://docs.aevral.com/docs/faq.md Does Aevral block merges, what does it look for, how do you get access, and who is behind it. ## Does Aevral block merges? No. The GitHub Check from a scan reports the outcome on the scanned commit; it never blocks a merge. PR review is live today as a free tier (25 private reviews per month). Claiming a new organization starts reviews on; Setup Complete or the Reviews page can turn them off. Its Check is advisory and its inline comments never block a merge either. ## What does Aevral look for? Today: authorization (who has access to what, enforced where, missed where), IDOR (object-level access checks that are missing or wrong), and business-logic access control (rules the code intends but does not enforce). Not memory corruption, not injection, not a general SAST. A finding is a lead with its evidence, not a confirmation; there is no patch generation, only a fix prompt you hand to Claude Code, Cursor, or Codex with a human review before merge. Details: [What a scan looks like](/docs/what-a-scan-looks-like). Across scans, the [findings worklist](/docs/findings-worklist) keeps those leads and a human archive. A later scan that omits a lead does not mean it is fixed. ## How do I get access? Aevral is self-serve: install the [GitHub App](https://github.com/apps/aevral), [log in to the console](https://app.aevral.com/login), and claim your install. Free organizations can use one lifetime private baseline when available; paid first scans use the included scan allowance. Questions or procurement: [contact form](https://tally.so/r/PdxdbV). ## What does it cost? Whole-repo scan plans in EUR per organization per month: Open source €0 (1 authorized public-repo scan per calendar month), Team €99 (4 default-branch scans, then €29), Business €399 (16, then €19), Enterprise get in touch. The PR security review is a USD add-on: Free $0 (25 private reviews per month, live today; new claims start reviews on), Starter $19 (100, then $0.49), Pro $99 (500, then $0.49), Business $249 (2000, then $0.49; paid plans live in the console). Whole-repo scan plans also gained the Scale rung: EUR 1,699 (100 scans, then EUR 17). All prices exclude VAT, B2B. Full tables: [Pricing and plans](/docs/pricing-and-plans). ## Is the GitHub App public? Yes. The App is public: install it on any account or organization from https://github.com/apps/aevral. Scan permissions are Contents read, Metadata, Checks write; the opt-in PR review adds Pull requests read and write: [GitHub App permissions](/docs/github-app-permissions). ## Who is behind Aevral? Aevral is a Better ISMS product, by [ISMS Copilot](https://ismscopilot.com). Security and legal corpus: [trust center](https://trust.ismscopilot.com), privacy: [privacy policy](https://trust.ismscopilot.com/privacy-policy). ## What is not live yet? A fully documented public API contract (keys exist today on the console Developer API page), and an MCP endpoint. Everything future-tense on this site stays future-tense until it ships. Paid PR plans and the findings worklist are live in the console. ## Do I need to return every week? PR reviews run automatically after a new organization is claimed. Setup Complete or the Reviews page can turn them off. Paid scan plans also support up to four automatic checkpoints per configured repository each billing month, sharing the included scan quota. They do not incur overage; unchanged commits reuse the report within the billing period and exhausted quota waits for renewal. This is not a free weekly private scan plan. See [Recurring scans and quota](/docs/pricing-and-plans#recurring-scans-and-quota). --- ## The findings worklist URL: https://docs.aevral.com/docs/findings-worklist Markdown: https://docs.aevral.com/docs/findings-worklist.md A per-repository list of scan leads across scans, with occurrence history, a human archive, and a fix prompt bound to one SHA. Open **Findings** in the [console](https://app.aevral.com/login) after you claim an install. A scan report is one snapshot at one commit. The findings worklist is the remembered list of those leads for a repository: what was reported, on which SHAs, and what a human archived. ## What it stores Each row is a reported authorization, IDOR, or business-logic lead. A lead is not a confirmation that the issue is real or still present. - First and last reported SHA - Occurrence history: each scan that indexed that lead - A human archive: dismissed or addressed, with the actor and time - A fix prompt for a selected occurrence SHA, the same packet as on the scan report A later scan that does not mention a lead does not mean it is fixed. Aevral does not auto-archive because a later scan omitted it. If a lead is archived and a later scan reports it again, it shows as reported again. Old archive rows stay. ## What it is not - Not a Sentry-style open versus resolved inbox - Not a patch generator - Not a GitHub issue writer - Not mixed with PR review comments - An empty worklist means no indexed leads. That is different from a scan that reported N findings on one SHA The GitHub Check is still the scan outcome on that commit, with a link to the report. It does not list the worklist. ## Start The worklist is part of the scan product. Open Findings in the [console](https://app.aevral.com/login) after you claim an install. Scan details: [What a scan looks like](/docs/what-a-scan-looks-like). --- ## For AI agents URL: https://docs.aevral.com/docs/for-ai-agents Markdown: https://docs.aevral.com/docs/for-ai-agents.md How coding agents should read Aevral docs. Machine surfaces are open for reading; the product is self-serve (public GitHub App, console login, Developer API keys). This page is the **discovery hub** for agents (Claude Code, Cursor, Codex, Grok, custom tools). Humans can use it too; agents should prefer the machine URLs below over scraping HTML chrome. ## Security model (read this) **READ open / EXECUTE locked.** - Public docs machine feeds are curl-open for agents. - Aevral is **self-serve**: install the public GitHub App at https://github.com/apps/aevral, then log in at https://app.aevral.com/login to claim the install. Never invent other install or login URLs. - `aevr_` API keys exist: one is minted automatically at claim (shown once, stored in your browser) and more can be minted from the console **Developer API** page, also shown once. They can start and read scans for their own organization; billing routes are console-session-only. The fuller public API contract is coming: do not invent endpoints beyond what the console uses. Never put keys in URLs. - Free organizations can use one lifetime private baseline when available (free, no card); paid first scans use included quota. ## Prefer these over HTML scrape | Resource | URL | Use when | | --- | --- | --- | | Docs index (llms.txt) | https://docs.aevral.com/llms.txt | Discover all EN pages | | Docs full dump | https://docs.aevral.com/llms-full.txt | Bulk ingest | | Per-page markdown | `Accept: text/markdown` on the HTML URL, or append `.md` | One clean article | | Agent search | https://docs.aevral.com/api/agent-search?q=scan | Keyword lookup | | Agent search (v1) | https://docs.aevral.com/api/v1/agent-search?q=scan | Versioned alias | | OpenAPI | https://docs.aevral.com/openapi.json | Docs search contract (no product API) | | Product site | https://aevral.com | Products, pricing, compare, guides | | GitHub App install | https://github.com/apps/aevral | Install on any account or organization | | Console login | https://app.aevral.com/login | Claim the install, run scans, enable PR review | | Contact | https://tally.so/r/PdxdbV | Questions, procurement | | Trust center | https://trust.ismscopilot.com | Security and legal corpus | ## Markdown convention ``` https://docs.aevral.com/docs.md → docs home https://docs.aevral.com/docs/setup-with-an-agent.md → setup steps in order https://docs.aevral.com/docs/what-a-scan-looks-like.md → scan product truth https://docs.aevral.com/docs/findings-worklist.md → remembered leads across scans https://docs.aevral.com/docs/what-a-pr-review-looks-like.md → PR review (live, opt-in per organization) https://docs.aevral.com/docs/pricing-and-plans.md → both SKUs, exact ladders https://docs.aevral.com/docs/works-alongside.md → coexists with your tooling https://docs.aevral.com/docs/github-app-permissions.md → permission set https://docs.aevral.com/docs/security-and-data.md → operational summary https://docs.aevral.com/docs/console-and-api-keys.md → console + Developer API keys https://docs.aevral.com/docs/faq.md → common answers ``` Responses are `text/markdown` with `Vary: Accept`, and `noindex` (do not rank as separate SEO pages). HTML stays `text/html` for browsers. ## Fast path: point a human at Aevral 1. Read [the overview](/docs) for what Aevral is: a security researcher for the whole repository (authorization, IDOR, business-logic access control), plus a live PR security reviewer (free tier, per-organization opt-in; paid plans live in the console). 2. Point the human at the self-serve path: install https://github.com/apps/aevral, then log in at https://app.aevral.com/login. Do not invent other sign-up flows, console logins, or install links. 3. Questions or procurement: https://tally.so/r/PdxdbV. 4. When the human asks what it costs, read [Pricing and plans](/docs/pricing-and-plans). EUR scan ladder, USD PR review add-on, both by organization, never by seat. English is product truth. The corpus is English-only in v1. --- ## GitHub App permissions URL: https://docs.aevral.com/docs/github-app-permissions Markdown: https://docs.aevral.com/docs/github-app-permissions.md What the Aevral GitHub App requests, why each permission exists, and what it never gets. The App is public and installable on any account. The Aevral GitHub App (name: `aevral`) is **public**: install it on any account or organization from https://github.com/apps/aevral. This page documents the permission set so you can review it before you install. ## Scan product permissions | Permission | Level | Why | | --- | --- | --- | | Contents | Read | Read the default-branch snapshot the scan analyzes | | Metadata | Read | Repository and organization structure (mandatory GitHub permission) | | Checks | Write | Post the scan Check on the scanned commit | That is the full set for the scan product. Nothing more. ## PR security review permissions The PR security review is live as a free tier (per-organization opt-in) and adds: | Permission | Level | Why | | --- | --- | --- | | Pull requests | Read and write | Read the diff and post the advisory Check and inline comments | Your organization accepts that permission at install. Claiming a new organization starts PR reviews on (the same default as the Setup checkbox). Installing the App without claiming does not process reviews. Setup Complete can still turn them off. Reconnecting an organization that opted out stays off. Reviews can also be managed from the Reviews page. Paid PR plans are live in the console. ## What the App never gets - **No write access to your code.** No push, no commit, no branch creation. The scan product reads contents and posts a Check. - **No user, secret, or deployment permissions.** - **No access to repositories you did not authorize.** Scans run on repos you explicitly authorized, on your trigger. Authorization is required to scan. ## What this means for review - A Check lands on the scanned commit (and, with the opt-in PR review, on the head commit of reviewed pull requests). - The Check never blocks a merge. - Findings stay in your console and your Checks; findings are not auto-published. Related: [What a scan looks like](/docs/what-a-scan-looks-like), [Security and data](/docs/security-and-data). --- ## Aevral docs URL: https://docs.aevral.com/docs Markdown: https://docs.aevral.com/docs.md Aevral is a security researcher on your whole repository, plus a live PR security reviewer, opt-in per organization. Start here. Aevral is two products from the [Better ISMS](https://ismscopilot.com) family: 1. **A whole-repo scan.** You start with a selected first scan during Setup, press Scan later, or configure recurring scans on a paid scan plan, and a security researcher goes through the default-branch snapshot of your repository the way a human would: cross-file context, authorization rules, the business logic behind who has access to what. Today it reads authorization, IDOR, and business-logic access control. Not memory corruption, not injection, not a general SAST. 2. **A PR security reviewer.** A security reviewer on your pull requests. Claiming a new organization starts PR reviews on. Setup Complete can turn them off. Free and paid review allowances are separate from scan plans. Aevral is self-serve: install the [GitHub App](https://github.com/apps/aevral) and [log in to the console](https://app.aevral.com/login) to claim your install. Complete Setup to pick the first scan, or to turn reviews off. Free organizations have one lifetime private baseline when available; paid organizations use their included scan allowance. ## Start here - [Set up with your agent](/docs/setup-with-an-agent): the setup steps in order, install to first report. - [What a scan looks like](/docs/what-a-scan-looks-like): console trigger, GitHub Check, report, fix prompt. No patches. - [The findings worklist](/docs/findings-worklist): remembered leads across scans, human archive, fix prompt on a SHA. - [What a PR review looks like](/docs/what-a-pr-review-looks-like): the per-organization opt-in PR review posts a Check plus inline comments, max two findings, on added lines. Free tier live; paid plans are live in the console. - [Pricing and plans](/docs/pricing-and-plans): both SKUs, the EUR scan ladder (now with the Scale rung) and the USD PR review add-on, opt-in per organization. - [Works alongside](/docs/works-alongside): Semgrep, Snyk Code, CodeQL, Aikido, GitHub Copilot code review, Bugbot, Socket. Aevral reads authorization, IDOR, and business-logic access control. Aikido's Code Security Audit is on [aevral.com/compare/aikido](https://aevral.com/compare/aikido). - [For AI agents](/docs/for-ai-agents): machine-readable hub. ## What Aevral does not do - **No patch generation.** A scan hands you a fix prompt for Claude Code, Cursor, or Codex. A human reviews before merge. - **No confirmation pass.** A finding is a lead, not a clean bill of health. - **The GitHub App is public.** Install it on any account or organization: https://github.com/apps/aevral. ## How Aevral runs - **Open-source models, hosted in the US or the EU.** Details on [Security and data](/docs/security-and-data). Questions: [contact form](https://tally.so/r/PdxdbV). Security and legal corpus: [trust center](https://trust.ismscopilot.com). --- ## Pricing and plans URL: https://docs.aevral.com/docs/pricing-and-plans Markdown: https://docs.aevral.com/docs/pricing-and-plans.md Both Aevral products: the whole-repo scan plans (EUR per organization) and the PR security review (USD per organization, no scan plan required). Verified against aevral.com/pricing. Aevral has two products, each priced by organization, never by seat. Whole-repo scans are priced in EUR with included scans per month. PR security review is priced in USD with included private reviews per month; its free tier is live (per-organization opt-in) and its paid plans are live in the console. One GitHub App and one console for both. Neither product requires the other, and the free PR review tier needs no subscription at all. Access is self-serve: [log in to the console](https://app.aevral.com/login) with your GitHub account and claim your install. The canonical marketing source is [aevral.com/pricing](https://aevral.com/pricing). These numbers and rules were reconciled against it and against the billing implementation on 2026-09-06. ## Whole-repo scan plans, EUR per organization per month, excluding VAT | Plan | Price | Included | Extra scan | Availability | | --- | --- | --- | --- | --- | | Public repositories | €0 | 1 authorized public-repo scan per calendar month | None; a second public scan that month is refused | Free | | Team | €99 | 4 default-branch scans per month | €29 per scan, opt-in | Self-serve | | Business | €399 | 16 default-branch scans per month | €19 per scan, opt-in | Self-serve | | Scale | €1,699 | 100 default-branch scans per month | €17 per scan, opt-in | Self-serve | | Enterprise | By quote, from €3,300 per month equivalent | 200 scans and up, annual commitment, invoice billing | €16.50 per scan minimum | By quote | Team, Business and Scale can be bought in the console. Private repositories start at Team. Team, Business and Scale differ by included volume and by the price of an extra scan; every plan carries the same product. Team, Business and Scale all support recurring repository scans, sharing the included scan allowance with manual scans. What every scan plan carries: - Whole-repo authorization / IDOR / business-logic scan on a default branch you authorized and triggered - GitHub Check and console report with evidence - Fix prompt for Claude Code, Cursor, or Codex - Open-source models, hosted in the US or the EU - Priced by organization, not by seat Public repositories here means authorized public repositories, not that the Aevral service is open source. Authorization is required to scan. Findings are not auto-published. Enterprise is sold by quote, not self-serve: a quote is a conversation with us through the [Aevral contact form](https://tally.so/r/PdxdbV). The Enterprise console features (SSO / SAML, RBAC, audit log, multiple GitHub organizations, invoice / PO tooling) are not shipped yet. Extras coming soon on Business and Scale: directory scope, Slack or webhook, CSV / Markdown export, documented dismissals. ## What counts as a scan, and when it resets A scan counts when it is newly admitted: you press Scan on a commit that has not been scanned in the period and it is accepted. Pressing Scan again on the same commit in the same period returns the existing scan and counts nothing. A scan that ran counts whether or not it found anything and whether or not it completed; only a scan that never ran is refunded. Included scans reset with the plan's billing period on Team, Business and Scale, and with the calendar month on Public repositories. No rollover. ## Recurring scans and quota Choose repositories once in the console. Each schedule checks at up to four checkpoints per billing month: the subscription period start plus 0, 7, 14 and 21 days. Enabling a schedule picks the next future checkpoint; it does not replay missed ones. After the fourth checkpoint, the next opportunity is the next billing period. This is not a weekly guarantee in five-week months. Automatic scans use the same included allowance as manual scans. An unchanged commit reuses the existing report for that period, without consuming another scan. If included quota is exhausted, recurring scans pause until renewal. They never authorize extra charges or consume the free private baseline. An owner or admin can pause a schedule, including after cancellation or removal of the GitHub installation. The console shows the next checkpoint and latest actual outcome. A new free organization can receive one lifetime private baseline scan when available; Setup shows eligibility. A paid organization's first scan uses its included allowance. There is no permanent free weekly private scan plan. ## Monthly cap on extra-scan spend Every paid organization can set a hard monthly cap on extra-scan spend, in the console under Billing. Only the organization owner can change or remove it. An extra scan that would push the period's extra-scan spend past the cap is refused with the exact numbers named; included scans and the free public-repo scan never touch the cap. Billing also shows the extra-scan amount billed so far in the period and alerts at 50, 75, 90, and 100 percent of the included allowance. The cap covers extra scans only; PR review has separate paid allowances and excess-review authorization. ## PR security review, USD per organization per month, excluding VAT PR security review is Aevral's second product. It needs no scan plan. Claiming a new organization starts PR reviews on. Installing the App without claiming does not authorize processing. Existing opt-outs remain off. Setup Complete or the Reviews page can turn them off. The App install must have accepted Pull-requests write. Reviews are never counted as scans, and scans are never counted as reviews: a review is never one of the included whole-repo scans of a scan plan. | Plan | Price | Included private reviews | Extra review | Availability | | --- | --- | --- | --- | --- | | Free | $0 | 25 private pull-request reviews per month | None; private reviews pause until next month | Live | | Starter | $19 | 100 included private reviews | $0.49 per extra review, opt-in only | Live | | Pro | $99 | 500 included private reviews | $0.49 per extra review, opt-in only | Live | | Business | $249 | 2000 included private reviews | $0.49 per extra review, opt-in only | Live | Public repositories are always free. Enabling PR review starts a 14-day trial with the first pull request Aevral processes after opt-in: private reviews are free up to 500, and the trial ends at 14 days or 500 reviews, whichever comes first. After the trial, 25 private reviews a month are free (trial-covered reviews do not consume the subsequent Free allowance); past that, a pull request gets a neutral Check and no review until the next month. No card. Paid plans are purchasable in the console. The billable-review definition and overage opt-in are shown before purchase, and $0.49 per extra review applies on every paid tier. The paid tiers are volume allowances of the same review; they differ by included reviews, not by features. What counts as a review: one pull request head (repository, pull request number, head commit). A new push is a new head and, if it is processed, a new review; the same head is never counted twice. A pending review for an older head is skipped without charge when a newer push arrives. A review holds its slot while it is pending or running and releases it if it is skipped, oversized or fails before posting; a posted review counts whether or not it found anything. The free allowance resets on the first day of each calendar month (UTC). What an opt-in review does: [What a PR review looks like](/docs/what-a-pr-review-looks-like). ## Common terms - **Two currencies**: scans bill in EUR; PR review bills in USD on its paid plans. Both per organization. - **VAT**: all prices exclude VAT. B2B. - **Extra scans**: manual extra scans need explicit confirmation and respect the scan spend cap. Excess private reviews require separate owner authorization. Scheduled scans never incur overage. - **Enterprise**: quoted from €3,300 per month equivalent (200 scans and up, €16.50 per scan minimum), annual commitment, invoice billing, via the [Aevral contact form](https://tally.so/r/PdxdbV); there is no separate sales mailbox. Questions: [Aevral contact form](https://tally.so/r/PdxdbV). --- ## Security and data URL: https://docs.aevral.com/docs/security-and-data Markdown: https://docs.aevral.com/docs/security-and-data.md Short operational summary of how Aevral handles your code and findings. The binding security and legal corpus lives in the trust center. This page is a short operational summary. The **binding** security and legal documents live in the trust center: [trust.ismscopilot.com](https://trust.ismscopilot.com). Privacy: [privacy policy](https://trust.ismscopilot.com/privacy-policy). If anything here reads differently from the trust center, the trust center wins. ## How your code is processed - **At rest, on your trigger.** A scan reads the default-branch snapshot of a repository you explicitly authorized, when you press Scan in the console. Not on every push. - **Authorization required.** Nothing is scanned that you did not authorize. Findings are not auto-published; they stay in your console and your Checks. - **Minimal GitHub permissions.** The App holds Contents read and Metadata read for the scan product; it never writes your code. The opt-in PR security review adds Pull requests read and write, used only to read the diff and post the advisory Check and inline comments. See [GitHub App permissions](/docs/github-app-permissions). ## Models and hosting Aevral uses open-source models, hosted in the US or the EU. Claiming a new organization starts PR reviews on; Setup shows the processing disclosure and can turn reviews off. The trust center lists current subprocessors. No model provider trains on your code. - **Scan worker:** Fly.io. - **Data store:** Supabase (Postgres). - **Frontends (site, docs, console):** Vercel. - **Payments:** Stripe. - **Repository access:** GitHub App, install-scoped tokens. ## PR review data PR review requires organization authorization. Claiming a new organization starts PR reviews on. Installing the App without claiming does not process reviews. Setup Complete or Reviews can turn them off; existing opt-outs stay off. An authorized review reads the pull-request diff plus up to 40 changed files at head, and posts an advisory Check plus inline comments. It never blocks a merge. Free organizations can use one lifetime private baseline when available; paid first scans use the included scan allowance. ## What Aevral does with findings - Each finding carries its evidence and a fix prompt you hand to Claude Code, Cursor, or Codex. - Aevral does not generate patches, does not commit, and does not open pull requests. - A finding is a lead, not a confirmation; there is no confirmation pass. ## Family Aevral is a Better ISMS product, by [ISMS Copilot](https://ismscopilot.com). The company behind it is Better ISMS EURL (Paris, France). Aevral runs on Fly.io, Supabase, Vercel, Stripe, GitHub, and hosted open-source models, alongside the family stack; the trust center carries the authoritative, current subprocessor list. B2B; prices exclude VAT. Better ISMS is getting ISO 27001 certified. We are not certified today. The intended scope includes Aevral. Read the intended scope at [trust.ismscopilot.com/en/iso-27001](https://trust.ismscopilot.com/en/iso-27001). Questions or concerns: [contact form](https://tally.so/r/PdxdbV). Report a security issue: the trust center carries the disclosure path. --- ## Set up with your agent URL: https://docs.aevral.com/docs/setup-with-an-agent Markdown: https://docs.aevral.com/docs/setup-with-an-agent.md How to start with Aevral today: install the GitHub App, log in to the console, claim your install, complete setup, and receive the first scan and ongoing PR reviews. Agents read this page, humans click. Aevral is self-serve. Claiming a new organization starts PR reviews on. Setup still records the first scan choice and can turn reviews off. A free private baseline is included once per organization when available; paid organizations use their included scan allowance. ## The steps in order 1. **Install the Aevral GitHub App** on your account or organization: https://github.com/apps/aevral. Permissions for the scan product: Contents read, Metadata, Checks write. The opt-in PR review adds Pull requests read and write. See [GitHub App permissions](/docs/github-app-permissions). 2. **Log in to the console** with your GitHub account: [app.aevral.com/login](https://app.aevral.com/login). Claim your GitHub App installation to link the organization and sync its repositories. 3. **Complete Setup.** New organizations already have PR reviews on from claim. You can uncheck them here; existing organizations' opt-outs stay off. Pick the repository for the first scan, or deliberately skip it. Setup starts the selected scan against its current default branch. No extra scan charge is authorized here. 4. **Read the results.** Open the first scan report from Setup. A queued scan is still waiting; an incomplete report is not a clean security result. If setup saved but the scan did not start, Setup keeps a retry action visible, including after reload. See [What a scan looks like](/docs/what-a-scan-looks-like). 5. **Hand the fix prompt to your coding agent.** Claude Code, Cursor, or Codex. A human reviews before merge. Aevral does not generate patches. 6. **Keep reviews running.** New pull request heads trigger reviews on the repositories selected in your GitHub App installation. Manage or disable them from Reviews. Missing pull-request write permission has a GitHub repair link. See [What a PR review looks like](/docs/what-a-pr-review-looks-like). 7. **Schedule paid repository scans.** On Team, Business or Scale, choose repositories under Automatic repository scans in the console. Each configured repository gets up to four checkpoints per billing month, sharing your included scan allowance. See [Recurring scans and quota](/docs/pricing-and-plans#recurring-scans-and-quota). ## What setup never asks for - **No write access to your code.** The scan product reads contents and posts a Check. It does not commit, push, or open pull requests. - **No card for the free allowance.** The available lifetime private baseline is free; prices are on [Pricing and plans](/docs/pricing-and-plans). - **No agent credentials.** Your coding agent gets a fix prompt, not access to your repositories. For coding agents: the install URL is https://github.com/apps/aevral and the console login is https://app.aevral.com/login. Never invent other endpoints, and never invent an `aevr_` API key: one is minted automatically at claim and more can be minted in the console Developer API page; keys are shown once. Machine-readable details: [For AI agents](/docs/for-ai-agents). --- ## What a PR review looks like URL: https://docs.aevral.com/docs/what-a-pr-review-looks-like Markdown: https://docs.aevral.com/docs/what-a-pr-review-looks-like.md The PR security review as it runs today (free tier, per-organization opt-in): an advisory Check plus inline comments on added lines, max two findings, silence when clean. Claiming a new organization starts PR reviews on. Setup Complete can still turn them off. Existing opt-outs stay off. Free includes 25 private reviews per month after the trial, and paid plans are live in the console. The PR security review is an opt-in add-on SKU inside Aevral. It is not one of the included whole-repo scans and not a replacement for the scan plans. USD per organization, B2B; paid plans are live in the console. ## How a review runs 1. **Trigger.** Pull requests opened, reopened, and synchronized in an opted-in organization. Each new head is a fresh review; the same head is never billed twice. 2. **Read.** The diff of the pull request is read, plus up to 40 changed files at head, hunting authorization, IDOR, and business-logic access control flaws. 3. **Post.** An advisory Check on the head commit plus inline comments pinned to the exact added lines. Never blocks a merge. 4. **Bound.** Hard max two findings per review. Silence when there is nothing to publish. ## Grounded on added lines Every inline comment is pinned to a line the pull request actually added, on a file the pull request actually touched. If the evidence cannot be grounded, the comment does not post. Oversized pull requests get a neutral note, not a partial review sold as complete. ## Plans Free tier: public repositories are always free, and private repositories get 25 pull-request reviews a month free. A 14-day private trial with a 500-review cap starts with the first reviewed pull request after opt-in, no card. Paid plans are purchasable in the console. PR security review plans, USD per organization per month (paid plans live in the console): | Plan | Price | Included private reviews | Past included | | --- | --- | --- | --- | | Free | $0 | 25 private pull-request reviews per month | Subscribe in the console, or wait for the next month. | | Starter | $19 | 100 included private reviews | $0.49 per extra review, opt-in only | | Pro | $99 | 500 included private reviews | $0.49 per extra review, opt-in only | | Business | $249 | 2000 included private reviews | $0.49 per extra review, opt-in only | Paid plans stop at their included allowance by default. An owner must explicitly authorize $0.49 excess private reviews. Failed or skipped reviews release their reservations; a new head commit is a new review, while replaying the same head does not count twice. Public reviews remain free. Scan and PR allowances are separate. ## Permissions note The scan product needs Contents read, Metadata, Checks write. The PR security review adds Pull requests read and write, accepted by your organization at install. Claiming a new organization starts reviews on; Setup Complete or the Reviews page can turn them off. See [GitHub App permissions](/docs/github-app-permissions). ## Start Install the [GitHub App](https://github.com/apps/aevral), [log in to the console](https://app.aevral.com/login), and claim the install (new organizations start with PR reviews on), or enable them later from Reviews. The whole-repo scan is a separate product with its own price: [What a scan looks like](/docs/what-a-scan-looks-like). --- ## What a scan looks like URL: https://docs.aevral.com/docs/what-a-scan-looks-like Markdown: https://docs.aevral.com/docs/what-a-scan-looks-like.md The whole-repo scan: press Scan in the console, a researcher reads the default-branch snapshot, you get a GitHub Check, a console report, and a fix prompt. No patches. The whole-repo scan is the first Aevral product. One scan covers your repository's default branch: cross-file context, authorization rules, the business logic behind who has access to what. ## How a scan runs 1. **Trigger.** You press Scan in the Aevral console. Aevral scans at rest, on your trigger. Not on every push. 2. **Read.** The scan goes through the default-branch snapshot of the repository the way a human security researcher would, following authorization logic across files. 3. **Report.** You get a GitHub Check on the scanned commit plus the full report in the console. Each finding carries its evidence: the code paths and rules behind it. 4. **Hand off.** Each finding comes with a fix prompt you can copy into Claude Code, Cursor, or Codex. A human reviews before merge. A finding is a lead, not a confirmation. A scan is not a clean bill of health. ## What the scan reads Today Aevral scans: - **Authorization**: who has access to what, enforced where, missed where. - **IDOR**: object-level access checks that are missing or wrong. - **Business-logic access control**: rules the code intends but does not enforce. Not memory corruption. Not injection. Not a general SAST. If you need those classes, keep the tools that do them: Aevral works alongside them, see [Works alongside](/docs/works-alongside). ## What you get | Surface | What it carries | | --- | --- | | GitHub Check | The scan outcome on the scanned commit, with a link to the report | | Console report | Every finding with its evidence and the affected code paths | | Findings worklist | Remembered leads across scans for that repository, with a human archive. Not enabled in production yet. [The findings worklist](/docs/findings-worklist) | | Fix prompt | Copy into Claude Code, Cursor, or Codex; a human reviews before merge | Aevral does not generate patches, does not commit, and does not open pull requests. ## Plans Scan plans, EUR per organization, HT B2B, excluding VAT: - **Open source: €0.** 1 authorized public-repo scan per calendar month. Open source here means authorized public repositories, not that the Aevral service is open source. Authorization is required to scan; findings are not auto-published. - **Team: €99 / org / month.** 4 default-branch scans per month, then €29 per extra scan. - **Business: €399 / org / month.** 16 default-branch scans per month, then €19 per extra scan. - **Scale: €1,699 / org / month.** 100 default-branch scans per month, then €17 per extra scan. - **Enterprise: get in touch.** Full details and the PR review add-on ladder (free tier live via per-organization opt-in; paid plans live in the console): [Pricing and plans](/docs/pricing-and-plans). The canonical marketing source is [aevral.com/pricing](https://aevral.com/pricing). ## Start Install the [GitHub App](https://github.com/apps/aevral), [log in to the console](https://app.aevral.com/login), and claim your install. Free organizations can use one lifetime private baseline when available; paid first scans use the included scan allowance. --- ## Works alongside URL: https://docs.aevral.com/docs/works-alongside Markdown: https://docs.aevral.com/docs/works-alongside.md Aevral runs next to the tools you already have. Semgrep, Snyk Code, CodeQL, Aikido, GitHub Copilot code review, Bugbot, CodeRabbit, Greptile, SonarQube, Codex Security, ZeroPath, AISLE, Tachyon, Gecko Security, Nullify, and Socket each do their stated job; Aevral reads authorization, IDOR, and business-logic access control. Aevral is not a replacement for the security tooling you already run. It reads the authorization logic of your whole repository: who has access to what, enforced where, missed where. Aikido also publishes Code Security Audit and Deep Review for authorization, IDOR, and business-logic reading of source. Aevral is built for that reading as a specialist GitHub App. Keep Aikido's platform. Detail: [aevral.com/compare/aikido](https://aevral.com/compare/aikido). ## The complementary roster | Tool | Its stated job | | --- | --- | | [Semgrep](https://semgrep.dev) | Rule and dataflow matching plus AI-powered detection whose scope includes IDOR and broken authorization | | [Snyk Code](https://snyk.io) | Static analysis (SAST) on your own code | | [CodeQL](https://codeql.github.com) | Deep semantic queries over a code database | | [Aikido](https://www.aikido.dev) | Platform (SAST, dependencies, secrets, IaC, pentest) plus [Code Security Audit](https://www.aikido.dev/code/code-audit) and Deep Review | | GitHub Copilot code review | General code review assistance on pull requests | | [Bugbot](https://cursor.com/bugbot) | AI code review for bugs on pull requests | | [CodeRabbit](https://www.coderabbit.ai) | AI code reviews on pull requests plus CodeRabbit Security monitoring | | [Greptile](https://www.greptile.com) | AI code review with full codebase context; TREX test agent | | [Socket](https://socket.dev) | Supply chain and package risk | | [SonarQube](https://www.sonarsource.com/products/sonarqube/) | Quality and security analysis with quality gates; Hunter Agent for logic flaws | | [Codex Security](https://developers.openai.com/codex/security) | OpenAI's application security agent: workbench scans, CLI and SDK, cloud scans, Security Review on pull requests | | [ZeroPath](https://zeropath.com) | AI-native SAST platform: business-logic and broken-auth detection, SCA, secrets, IaC, DAST, pull-request reviews with autofix | | [AISLE](https://aisle.com) | AI-native vulnerability management: snapshot scans in cloud, on-prem, or air-gapped deployments, agent analysis, fix agents | | [Tachyon](https://tachyon.so) | AI code security reviews in full-codebase context with exploit validation and a fix per finding | | [Gecko Security](https://gecko.security) | Semantic graph analysis of code, logic, and infrastructure, with cross-repo scanning and a PR review bot | | [Nullify](https://nullify.ai) | Autonomous product security: validated findings driven to merge-ready remediation PRs | Each of these does its stated job. Aevral's job is a security researcher reading the whole repository's authorization, IDOR, and business-logic access control, on your trigger, with evidence per finding. Aevral's own PR security review is live (claiming a new organization starts reviews on; Setup Complete or the Reviews page can turn them off); paid plans are live in the console. ## What Aevral adds - Whole-repo, cross-file authorization reading. - A fix prompt you hand to Claude Code, Cursor, or Codex; a human reviews before merge. - Findings as leads with evidence, not a clean bill of health. ## What Aevral does not cover Not memory corruption. Not injection. Not secrets, dependencies, or supply chain. Not a general SAST. Keep the tools that cover those classes; Aevral runs beside them. Worked examples per tool live on the marketing site: [aevral.com/checks](https://aevral.com/checks). Scan details: [What a scan looks like](/docs/what-a-scan-looks-like). Pricing: [Pricing and plans](/docs/pricing-and-plans).