The free security check
A free, one-time scan of the settings that decide how bad a breach gets.
What it looks at
| Check | What Averil looks for |
|---|---|
| AI spending limits | A spend alert that covers AI services such as Amazon Bedrock, so a leaked key costs dollars instead of thousands |
| Shared or long-lived keys | Access keys and tokens not rotated in 90 days, active keys unused for 90 days, and tokens that expire more than a year out |
| Public databases | RDS instances that are publicly accessible or unencrypted, and Supabase databases reachable from any address |
| Forgotten OAuth apps | Grants not used for 90 days, or never used 180 days after they were made |
| Former employees with access | People missing from your directory or suspended, who still have accounts in GitHub, Slack, Railway or elsewhere |
| Security settings turned off | Two-factor, branch protection, secret scanning and push protection, GuardDuty, Security Hub, CloudTrail, SSL enforcement |
| Where each secret lives | Secret names in GitHub Actions, AWS Secrets Manager and Railway, and names stored in three or more places |
Secrets are listed by name only. Averil never requests their values.
Which tools feed which check
| Tool | Feeds |
|---|---|
| GitHub | Long-lived keys, former employees, security settings, where secrets live |
| AWS | AI spending limits, long-lived keys, public databases, security settings, where secrets live |
| Google Workspace | Forgotten OAuth apps, former employees, security settings |
| Slack | Forgotten OAuth apps, former employees |
| Supabase | Public databases, security settings |
| Railway | Former employees, security settings, where secrets live |
Connect what you use. Each section of the report says what was checked and what could not be, so a missing tool shows as a gap, not as a pass.
How to request it
- 1Fill in the form at /readiness with your work email, company and the tools you use.
- 2We reply to set up read-only connections with you. It takes a few minutes per tool.
- 3Averil runs the scan once and sends the results to you in Slack.
You can also book a time with the founders and run it together.
Read-only, start to finishThe check uses the same read-only access described in Connect your tools. It changes nothing. Vercel is coming soon.
Stuck? Email averil@averil.ai or ask me in Slack.