1
Connect a repository
Open the dashboard and go to Settings >
Integrations. Connecting doesn’t start a scan; you choose what to scan
next.
- GitHub: install the Gecko GitHub App and pick repositories. See Connect GitHub.
- GitLab: add a GitLab access token and instance URL. See Connect GitLab.
Self-managed GitLab or an IP-restricted network? Allowlist Gecko’s IP
addresses first, or the connection will fail. See Network & IP allowlist.
2
Run a baseline scan
Click New Scan in the sidebar, choose a repository your team knows well,
and scan its default branch.This builds a repository wiki, maps your
API endpoints, and produces your first set of findings:
the security baseline you’ll improve from. A scan with few or no findings is
a normal result; Gecko reports only paths it is confident are exploitable.
3
Review findings
Open Findings in the sidebar. Each finding includes a severity (CVSS 4.0),
the full source-to-sink call chain, a proof of concept,
and a suggested patch.Start with anything touching auth, secrets, remote execution, or external
network access. Mark findings that don’t apply as False Positive. See
False positives and context.
4
Fix and verify
On the finding’s Fix tab, click Create PR to open a
gecko/* pull
request with the patch applied, or fix it yourself. Merging Gecko’s PR marks
the finding Fixed.To have Gecko confirm fixes you write yourself, turn on
Settings > Scanning > Fix detection and re-scan the branch
the fix merged into. See Fix and verify.Next steps
Roll Gecko out to your organization
A staged plan for connecting, scanning, and enforcing across many repositories.
Turn on PR checks
Scan every pull request and block merges above a severity threshold.
Route findings to your tools
Jira, Linear, Slack, ClickUp, and Shortcut.
Connect your AI tools
Triage findings from Claude, ChatGPT, Codex, or Cursor.
Invite your team
Roles and the permission matrix.
Set up SSO
SAML or OIDC sign-on for your team.