September 2026

​

Findings

• Command palette: Press ⌘K to start a New scan, Invite teammates, Create an API key, Connect an integration, or Ask Gecko. From a finding, ask Gecko to explain it and how to fix it.
• Context page: Rules, Endpoints, and Wiki in one place, with a repository and version picker and auth and reachability indicators on endpoints. See Rules and API spec.

​

Scanning

• Bulk scans: Select up to 20 repositories and choose Actions → New Scan.
• No build required: Gecko indexes source code directly, so scans no longer depend on your build tooling.

​

Integrations

• DefectDojo: Connect under Settings → DefectDojo. Gecko reimports results after each non-PR scan and tags findings with OWASP ASVS 4.0.3 or 5.0.0 controls. See DefectDojo.

​

Bug fixes

• MCP and API status changes: Update the GitHub check, the GitLab commit status, and the PR thread, and show as (MCP) or (API) in the activity.
• Self-hosted links: Point at your own GitHub or GitLab host, and multi-repo scans link each finding to the right provider.
• GitHub Enterprise Server: Pull request webhooks are processed.

​

Findings

• Report feedback: Send feedback from Settings → Support and get email updates as we act on it.

​

Bug fixes

• Repository counts: Open-finding counts are correct.

​

Access

• Service accounts: Create a Service account token for CI and automation that isn’t tied to a person. See Service accounts.
• Expiring API keys: Set an Expiration on every key. New keys default to 30 days. See API keys.

​

Integrations

• Snowflake: Export findings under Settings → Snowflake.
• Linear app: Linear connects as the Gecko app. Existing connections show Reconnect needed.
• Smaller auto-fix patches: Fixes change only the vulnerable file.

​

Access

• SSO and SCIM: Rotate tokens, map IdP groups to roles, and IdP-initiated sign-in turns on automatically. See SSO & SCIM.
• Usage page: Your team’s usage, with an Active committers card.