Averil is live on Product Hunt Join the conversation

Schedule a demoBook a demo
Product
Incident responseLeaked secretsVendor breachesThreat watchAccess reviewsDevice securityPR reviewsNightly scansHow it worksIntegrationsMCP for AI toolsMorning briefAll features →
Solutions
StartupsEngineering teamsSecurity teamsCloud securityCode securityIdentity and accessCompliance evidenceAll solutions →
Trust
Trust centerAccess manifestReport a vulnerabilityStandardsSubprocessorsAudit evidence
Resources
DocsBlogGetting startedPermissions and dataFree security checkConnect SlackContact us
Pricing

Hi, I'm Averil. Your new Security Engineer.

Your team ships fast. The alerts pile up and nobody owns them. I join your workspace, learn your code, cloud and devices, and take every issue from the first alert to a fix that's checked in production.

Book a demoSee how it works
# eng
Integrates withSlackSlackGitHubGitHubAWSAWSGoogle WorkspaceGoogle WorkspaceRailwayRailwaySupabaseSupabase More tools
Intelligence

Thousands of signals in. Only the real ones reach you.

  1. 01Everything you run gets mapped.Repos, keys, buckets, admins, OAuth apps and deploys, across every tool you connect.
  2. 02Every signal is watched.Commits, alerts, sign-ins and advisories, day and night.
  3. 03Only what’s real gets through.Each lead is checked against evidence. Anything that can’t be proven is dropped, with the reason.
  4. 04Fixes are checked in production.A pull request or an approved change, then a check on your live systems before the case closes.
GitHubGitHubAWSAWSGoogle WorkspaceGoogle WorkspaceRailwayRailwayFixedFixed in PR #14, exploit test passesFixedUpgraded in PR #22, checked liveFixedKey deactivated, calls failingDroppedMeant to be public. DroppedDroppedJoseph confirmed it was himDroppedRailway already patched it. Dropped
1,284Resources mapped2,317Signals checked3Proven3Fixed and checked
Why Averil

You've tried the scanners. The work is still yours.

Most security tools find problems and hand them to you. I find them, prove them, fix them and check the fix.

A pull request lets anyone read every orderA typical scannerFlags a line as “possible SQL injection”.AverilProves it with a test, writes the fix and puts it on the PR.
A library you use gets a critical CVEA typical scannerLists every repo with that version.AverilFinds the one attackers can actually reach and upgrades it.
Your AWS key is used from new IPsA typical scannerPosts an alert to a channel.AverilChecks what was touched, then turns the key off once you say so.
A key leaks in a commitA typical scannerOpens a ticket.AverilFinds every copy and rotates them in the right order.
Someone left the company last monthA typical scannerNot its job.AverilFinds the accounts, tokens and app access they still have.
Compare Averil with Snyk, Wiz, Vanta and others

Get started in three steps

GitHubAWSRailwaySupabase
SlackGitHubJ
Connect your toolsAdd Slack, GitHub and your cloud. It takes about twenty minutes.
MemoryPage Joseph for anything on ledger-apiAsk before rotating production keysStay quiet after 10pm unless it's highThe payments database is critical
I learn from how your team operatesI only remember what someone on your team confirms. Each decision you make teaches me who owns what and what matters most.
07:00 brief: 4 cases, 2 need you.
PR #418 trusts the tenant ID in the request body.
I left a one-line fix on the PR.
Nice. Can you re-check after I push?
Also, quiet hours start at 10.
Will do. I'll only page you if it's high.
I keep watch overnightI investigate overnight, stay quiet unless it's serious, and send you a summary at 7:00 AM.

Built for teams with or without a security team.

FOUNDERS AND CTOSSecurity covered before your first security hireCode reviews, cloud alerts, leaked keys and audit evidence, handled by me while you build.
ENGINEERING LEADSFixes, not ticketsProblems arrive as a pull request with a test that proves them, in the repos and Slack channels you already use.
SECURITY TEAMSMore hands on every alertI do the legwork on each alert and hand you the evidence, so your team spends its time on the calls that matter.

Built so I can’t overstep.

Read about security
No long-lived cloud keysI reach your infrastructure through a role you control, with short-lived tokens.
Checked in productionI close a case only when your live systems match the fix, not when I think it worked.
Every action on recordEvery read and write goes into an action log you can inspect. Entries are chained, so nobody can quietly edit them.
I won’t flood your SlackApart from updates on cases you’re already working on, I message each person three times a week at most. Anything critical still reaches you right away.

Questions

Anything else? Email averil@averil.ai.

What does Averil actually do?

I connect to GitHub, your cloud and the other tools you run, look for security problems, prove which ones are real, fix them, and check the fix worked in your live systems. You talk to me in Slack.

What does it connect to?

Slack, GitHub, AWS, Google Workspace, Railway and Supabase today, with more on the way. Connect one and add the rest when you’re ready.

How is this different from Snyk or Dependabot?

Scanners list possible problems and leave the rest to you. I prove which ones are real, write the fix, and close the case only when your live systems show it worked.

How long does setup take?

About twenty minutes for Slack, GitHub and your cloud. I start reviewing the same day.

Is my code safe with you?

Your data is never used to train AI models, and keys and tokens are removed before anything reaches a model. The Trust page lists every permission I use.

What does it cost?

The Indie Hacker plan is free for Slack and GitHub. Team and Enterprise are priced per company, not per seat.

Start with a free
security check

Connect GitHub and your cloud, and I'll send you a short list of what to fix, in Slack.

Get a free security checkSee pricing