[AEV-ral·authz + IDOR, at rest]

Broken access control,
found at rest.

Aevral reads your default branch for the authorization gaps, IDOR, and business-logic flaws that scanners which only parse syntax walk straight past. One job, done at the depth a security engineer would.

Notify me by ISMS Copilot

No account, no send. Prefer email? contact@ismscopilot.com

no per-seatEU inferenceAPI-first

api/orders/[id]/route.tsmain

14export async function GET(req, { params }) {

15 const order = await db.order.findById(params.id)

16 return Response.json(order) // no owner check

17}

AevralIDORauthorizationat rest

GET /orders/:id returns any order by id. No check that the record belongs to the caller's org, reachable from an unprivileged session.

11 confirmed finding/default branch

illustrative. one class of many.

say it AEV-ral, not Aerial

Pricing

No per-seat

Priced by organization and usage. Add engineers without adding line items.

Quota

4 scans, then €29

€99 per org each month covers four default-branch scans. Extra scans are €29.

Inference

EU, on Mistral

Your code is read for analysis inside the EU. No US model provider in the loop.

What Aevral is

Scope: Authorization, IDOR, and business-logic flaws. At rest, on your default branch.
Not a suite: One job done to depth, not a GRC platform bolted onto a scanner.
Pricing: Per organization and usage. Never per-seat.
Agents: The same HTTP API as the console. API-first, EU inference.

Coming soon

Get notified when Aevral opens.

Notify me

or email contact@ismscopilot.com

Broken access control, found at rest.

Get notified when Aevral opens.

Broken access control,
found at rest.