> ## Documentation Index
> Fetch the complete documentation index at: https://gecko.security/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Roll out Gecko across your organization

> The order to turn things on when a security team brings Gecko to many repositories and teams.

This guide is for the security or platform team setting Gecko up for an
organization. Each step builds on the one before it, so you get useful results
early and add enforcement only once the results are trusted.

**1. Connect your code hosts**

Go to **Settings** > **Integrations** and connect GitHub or GitLab under
**Source Control**. You can attach several GitHub organizations to one team.
See [Connect GitHub](https://gecko.security/docs/connect/github.md) and [Connect GitLab](https://gecko.security/docs/connect/gitlab.md).

Connecting is safe to do first: it doesn't start any scans, and repositories
sync with PR scanning turned off.

**2. Baseline your most important repositories**

Click **New Scan** and run a [deep scan](https://gecko.security/docs/concepts/scans.md) of the default
branch for a handful of repositories that matter most: internet-facing
services, anything handling authentication, payments, or sensitive data.
Review those findings with the owning teams before scanning everything. See
[Run a scan](https://gecko.security/docs/scanning/run-a-scan.md).

**3. Turn on fix detection**

Turn on **Settings** > **Scanning** > **Fix detection** so later scans close
findings that have been fixed in the code. Without it, findings fixed outside
Gecko stay open until someone closes them. See
[Re-scans and fix detection](https://gecko.security/docs/concepts/rescans.md#fix-detection).

**4. Schedule recurring scans**

Add a [scheduled scan](https://gecko.security/docs/scanning/scheduled-scans.md) for each repository's
default branch: **Weekly** for critical services, **Monthly** for legacy or
rarely changed code. Use **Multi-repo** for services that only make sense
together, such as an API and the gateway in front of it.

**5. Add PR scanning gradually**

Turn on **PR Scanning** per repository, starting with teams that want it.
Begin with **PR Status Checks** off, or with the failure threshold at
**Critical**, so developers see comments without blocked merges. Tighten the
threshold once the team trusts the results. See
[Pull request checks](https://gecko.security/docs/scanning/pr-checks.md).

**6. Set up access**

Connect [SSO and SCIM](https://gecko.security/docs/access/self-managed-sso.md) so people sign in with your
identity provider and leave when they're deprovisioned. Assign
[roles](https://gecko.security/docs/teams-permissions.md) by what each person needs to change.

To limit each developer to the repositories they can push to, turn on
**Settings** > **Members** > **Enforce GitHub/GitLab permissions**. Link your
own GitHub or GitLab account first so you keep access, and tell developers to
link theirs under **Settings** > **General** > **Personal connections**. ZIP
uploads are turned off while enforcement is on. See
[Identity model](https://gecko.security/docs/access/identity-model.md).

**7. Route findings to where teams work**

Connect [Jira](https://gecko.security/docs/jira-integration.md) or another
[issue tracker](https://gecko.security/docs/integrations.md) and map Gecko's statuses to your workflow, so
closing the ticket and changing the status in Gecko stay in step. Connect
[Slack](https://gecko.security/docs/slack-integration.md) for notifications.

**8. Teach Gecko your environment**

As teams triage, write [rules](https://gecko.security/docs/scanning/rules.md) for anything Gecko can't see
in the code, such as auth enforced at a gateway. One rule removes a whole
class of false positives on every later scan. See
[False positives and context](https://gecko.security/docs/guides/false-positives-and-context.md).

**9. Automate fixes, if you want them**

Once teams are used to Gecko's patches, turn on **Auto-create Pull Requests**
so fix PRs open as soon as a scan finishes. See
[Auto-fix PRs](https://gecko.security/docs/remediation/auto-fix-prs.md#pull-request-settings).

## Share with developers

Send developers [Gecko for developers](https://gecko.security/docs/guides/developers.md). It covers what
they'll see on pull requests, how to read and fix a finding, and how to
disagree with one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.