Skip to main content
There are two separate questions after Gecko reports a finding: how do you fix it, and how does Gecko learn that it’s fixed? This guide covers both.

​
Choose how to fix it

Open the finding and go to the Fix tab. It shows Gecko’s suggested patch as a diff against the affected files.

Let Gecko open the PR

Click Create PR (Create MR on GitLab). Gecko opens a pull request with the patch applied. Merging it marks the finding Fixed right away.

Fix it yourself

Use the patch as a starting point, or write your own fix, and ship it through your normal review process. Gecko confirms it on a later scan.
If the finding came from a pull request scan, the button reads Commit & Push Fix to PR and adds the fix as a commit on that pull request instead of opening a new one. To fix several findings in one change, select them in the Findings table and use the Fix bulk action. Gecko opens one combined pull request. The selected findings must come from the same repository and the same scan. See Auto-fix PRs for branch names, draft PRs, labels, and automatic PR creation.

​
How a finding becomes Fixed

If you close a Gecko fix PR without merging it, the finding goes back to Open.

​
Confirm a fix you merged yourself

This is the path that causes the most confusion, so here it is step by step.
1

Turn on fix detection once

An admin enables Settings > Scanning > Fix detection. Without it, a deep scan never closes a finding on its own. See Re-scans and fix detection.
2

Merge the fix into the branch Gecko scans

Fix detection checks the code on the scanned branch. A fix that only exists on a feature branch is not visible to a scan of main.
3

Scan that branch

Run a scan of the default branch from the repository page, or wait for its scheduled scan. Don’t scan the feature branch the fix was written on: findings there belong to a different line of history.
4

Check the finding's Activity tab

If Gecko confirmed the fix, the finding is Fixed and Activity explains why the path is no longer exploitable and names the commit. If it’s still Open, Gecko wasn’t confident the issue is gone. Read the call chain again, or mark it Fixed yourself.
Fix detection skips findings that have a linked ticket or a fix in progress, so it never overrides work someone owns. If you track a finding in Jira or Linear, close it there or set the status in Gecko.

​
If it comes back

When a Fixed finding is detected again by any later scan, Gecko reopens it with “Reopened after a scan detected this finding again.” The history stays on the finding, so you can see when it regressed.

​
Suggested fix vs fix detection

These are two different features that are easy to mix up:
  • Suggested fix is the patch Gecko proposes on the Fix tab. It does nothing until you turn it into a PR or apply it yourself.
  • Fix detection is a setting that rechecks open findings during deep scans and closes the ones whose code is fixed. It works whether or not you used Gecko’s patch.