> ## Documentation Index
> Fetch the complete documentation index at: https://gecko.security/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Gecko for developers

> What a developer sees from Gecko day to day, and how to act on a finding from a pull request, the dashboard, or your editor.

Your security team has connected your repositories to Gecko. This guide covers
what you'll see and what to do with it. You don't need to configure anything to
get started.

## Sign in and link your account

Sign in to the [dashboard](https://app.gecko.security) with your company's
sign-in. Then go to **Settings** > **General** > **Personal connections** and
link your GitHub or GitLab account.

> [!NOTE]
>
> If your team enforces repository permissions, you only see repositories you
> can push to, and you see none until you link your account. If the
> **Repositories** page is empty, link your account first. See
> [Identity model](https://gecko.security/docs/access/identity-model.md).

## On your pull requests

When PR scanning is on for a repository, Gecko scans each pull request (merge
request on GitLab) and reports back on it:

* **A status check** that passes or fails, depending on whether any finding
  meets your team's severity threshold.
* **A review comment** with a security-focused summary of the change and any
  findings it introduces.

A PR scan reads the diff in the context of the whole repository, using the
repository's latest [wiki](https://gecko.security/docs/concepts/repository-wiki.md) to understand how the
changed code is reached. It reports issues your change introduces, not the
repository's existing backlog.

Whether Gecko rescans when you push more commits depends on your team's
**PR Scan Trigger** setting: **Every Push**, or **PR Open & Reopen**. When the
PR is rescanned and a finding it reported is gone, Gecko marks that finding
**Fixed**. See [Pull request checks](https://gecko.security/docs/scanning/pr-checks.md).

## Read a finding

Click a finding to open it. Its tabs answer the questions you'd ask in review:

| Tab | What's there |
| - | - |
| **Overview** | What's wrong and the [call chain](https://gecko.security/docs/concepts/findings.md#the-function-call-chain): each step from where input enters to the dangerous operation, with file and line. |
| **Exploit** | A proof of concept showing how the path is triggered. |
| **Fix** | Gecko's suggested patch as a diff, and the button to apply it. |
| **CVSS** | The CVSS 4.0 vector behind the severity score. |
| **Activity** | Every status change, who made it, and notes. |

The **Findings** page lists everything you can see. Use the **Default branch**
and **Pull requests** tabs to separate your repository's backlog from findings
on open pull requests.

## Fix it

From the **Fix** tab:

* **Commit & Push Fix to PR** adds Gecko's patch as a commit on the pull
  request where the finding was reported.
* **Create PR** (**Create MR** on GitLab) opens a new pull request with the
  patch, for findings on the default branch.

You can also fix it yourself. See
[Fix a finding and confirm it's gone](https://gecko.security/docs/guides/fix-and-verify.md) for how Gecko
picks up fixes it didn't write.

## Disagree with it

If a finding isn't exploitable, set its status to **False Positive** and leave
a note on the **Activity** tab explaining why. Your security team sees the
note. If the reason is something Gecko can't see in the code, such as a check
in another service, ask them to add a [rule](https://gecko.security/docs/guides/false-positives-and-context.md#teach-gecko-what-it-cant-see).

## Work from your editor

Connect Gecko to Claude Code, Codex, Cursor, or another MCP client to list
findings, read the call chain, and fix them without leaving your editor. The
agent acts with your permissions, never more. See
[AI agents](https://gecko.security/docs/ai-tools/overview.md) and [Claude Code](https://gecko.security/docs/ai-tools/claude-code.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.