ISMS Copilot Docs

What is Aevral

Aevral is a GitHub App from the ISMS Copilot team that reviews pull requests for authorization, IDOR, and business-logic flaws. It is a separate product with its own site, console, docs, and pricing.

Aevral is a security agent for your code, built by the same team as ISMS Copilot (Better ISMS). It runs as a GitHub App and catches security flaws in your pull requests before you merge.

Aevral is a separate product, not an ISMS Copilot feature. It has its own site, console, documentation, and billing. An ISMS Copilot plan does not include Aevral, and an Aevral plan does not include ISMS Copilot.

What Aevral does

  • Pull request security review. Once the GitHub App is installed, Aevral reviews your pull requests for authorization, IDOR, and business-logic flaws. It posts a GitHub Check on the head commit plus inline comments on the added lines, with a suggested fix you apply in your own coding agent or editor.
  • Whole-repository scan. Aevral can also read the default branch of a repository for the same class of access-control flaws, with a GitHub Check on the scanned commit and a report with evidence in the Aevral console.

A finding is a lead with evidence, not a confirmation, and no patch is applied automatically. Aevral is not a general static analysis tool: it does not look for memory corruption or injection.

Get started

  1. Open aevral.com/install and install the Aevral GitHub App on the organization or repositories you choose.
  2. Log in to the Aevral console to claim your installation.

Pricing

Aevral is priced per organization, not per seat. Public repositories are free within monthly limits. Private repositories get a free allowance, and paid plans are available in the Aevral console. Current plans and limits are on aevral.com/pricing.

Aevral and heyGRC

Both run on pull requests, and they answer different questions:

  • heyGRC checks whether a change touches something your compliance programme (ISO 27001, SOC 2, GDPR, DORA) cares about. Standard, Pro, Business, and Unlimited plans include a monthly heyGRC allowance; see heyGRC included with your plan.
  • Aevral checks whether a change introduces an exploitable security flaw, such as missing authorization or an IDOR.

Learn more

On this page

What Aevral doesGet startedPricingAevral and heyGRCLearn more