1
Connect your code hosts
Go to Settings > Integrations and connect GitHub or GitLab under
Source Control. You can attach several GitHub organizations to one team.
See Connect GitHub and Connect GitLab.Connecting is safe to do first: it doesn’t start any scans, and repositories
sync with PR scanning turned off.
2
Baseline your most important repositories
Click New Scan and run a deep scan of the default
branch for a handful of repositories that matter most: internet-facing
services, anything handling authentication, payments, or sensitive data.
Review those findings with the owning teams before scanning everything. See
Run a scan.
3
Turn on fix detection
Turn on Settings > Scanning > Fix detection so later scans close
findings that have been fixed in the code. Without it, findings fixed outside
Gecko stay open until someone closes them. See
Re-scans and fix detection.
4
Schedule recurring scans
Add a scheduled scan for each repository’s
default branch: Weekly for critical services, Monthly for legacy or
rarely changed code. Use Multi-repo for services that only make sense
together, such as an API and the gateway in front of it.
5
Add PR scanning gradually
Turn on PR Scanning per repository, starting with teams that want it.
Begin with PR Status Checks off, or with the failure threshold at
Critical, so developers see comments without blocked merges. Tighten the
threshold once the team trusts the results. See
Pull request checks.
6
Set up access
Connect SSO and SCIM so people sign in with your
identity provider and leave when they’re deprovisioned. Assign
roles by what each person needs to change.To limit each developer to the repositories they can push to, turn on
Settings > Members > Enforce GitHub/GitLab permissions. Link your
own GitHub or GitLab account first so you keep access, and tell developers to
link theirs under Settings > General > Personal connections. ZIP
uploads are turned off while enforcement is on. See
Identity model.
7
Route findings to where teams work
Connect Jira or another
issue tracker and map Gecko’s statuses to your workflow, so
closing the ticket and changing the status in Gecko stay in step. Connect
Slack for notifications.
8
Teach Gecko your environment
As teams triage, write rules for anything Gecko can’t see
in the code, such as auth enforced at a gateway. One rule removes a whole
class of false positives on every later scan. See
False positives and context.
9
Automate fixes, if you want them
Once teams are used to Gecko’s patches, turn on Auto-create Pull Requests
so fix PRs open as soon as a scan finishes. See
Auto-fix PRs.