Skip to main content
Your security team has connected your repositories to Gecko. This guide covers what you’ll see and what to do with it. You don’t need to configure anything to get started. Sign in to the dashboard with your company’s sign-in. Then go to Settings > General > Personal connections and link your GitHub or GitLab account.
If your team enforces repository permissions, you only see repositories you can push to, and you see none until you link your account. If the Repositories page is empty, link your account first. See Identity model.

​
On your pull requests

When PR scanning is on for a repository, Gecko scans each pull request (merge request on GitLab) and reports back on it:
  • A status check that passes or fails, depending on whether any finding meets your team’s severity threshold.
  • A review comment with a security-focused summary of the change and any findings it introduces.
A PR scan reads the diff in the context of the whole repository, using the repository’s latest wiki to understand how the changed code is reached. It reports issues your change introduces, not the repository’s existing backlog. Whether Gecko rescans when you push more commits depends on your team’s PR Scan Trigger setting: Every Push, or PR Open & Reopen. When the PR is rescanned and a finding it reported is gone, Gecko marks that finding Fixed. See Pull request checks.

​
Read a finding

Click a finding to open it. Its tabs answer the questions you’d ask in review: The Findings page lists everything you can see. Use the Default branch and Pull requests tabs to separate your repository’s backlog from findings on open pull requests.

​
Fix it

From the Fix tab:
  • Commit & Push Fix to PR adds Gecko’s patch as a commit on the pull request where the finding was reported.
  • Create PR (Create MR on GitLab) opens a new pull request with the patch, for findings on the default branch.
You can also fix it yourself. See Fix a finding and confirm it’s gone for how Gecko picks up fixes it didn’t write.

​
Disagree with it

If a finding isn’t exploitable, set its status to False Positive and leave a note on the Activity tab explaining why. Your security team sees the note. If the reason is something Gecko can’t see in the code, such as a check in another service, ask them to add a rule.

​
Work from your editor

Connect Gecko to Claude Code, Codex, Cursor, or another MCP client to list findings, read the call chain, and fix them without leaving your editor. The agent acts with your permissions, never more. See AI agents and Claude Code.