Skip to main content

​
Choose the right scan input

Gecko supports a few practical ways to start analysis:

GitHub

Best for private repositories that already live in the normal engineering workflow.

GitLab

Best for GitLab-native teams that want repeatable repository-backed scans.

Public OSS URLs

Best for evaluating Gecko on public GitHub or GitLab repositories without a private provider connection.

ZIP uploads

Best for point-in-time analysis when code is not available through a supported provider.
1

Connect one provider first

Start with the code host your team already uses for private repositories.
2

Select one repository with clear ownership

The first scan is easier to operationalize when the team already knows who can validate and fix issues.
3

Run a baseline scan on the default branch

Do not overcomplicate the first run with too many variables.
4

Expand after the first clean loop

Once the team trusts the workflow, add more repositories, repeat scans, and the rest of the integrations.

​
When each option is the right fit

Provider-backed repositories are the best fit when you want repeatable scans, durable repository records, and cleaner follow-up work.
Public URLs are useful when you need signal quickly without setting up a private provider integration first.
ZIP uploads work when you need a point-in-time scan for code that is not otherwise reachable through Gecko.