Gecko Security
Gecko Security is an AI security engineer for development and security teams. It traces untrusted input through code, logic and infrastructure to confirm genuinely exploitable vulnerabilities, then ships a ready-to-apply patch straight into your CI/CD pipeline.
What is Gecko Security?
Gecko Security is an application security platform that presents itself as an AI security engineer rather than as another scanner. It is published by Gecko Security, Inc., a Y Combinator company from the Fall 2024 batch, with a team based in London.
At its core is a Claude-powered agent that reads code the way a security engineer would: it follows untrusted input from the point where it enters the application to the point where it does damage, and reports an issue only once it can prove the path is exploitable. Underneath sits a compiler-accurate graph of the codebase, built from semantic name bindings closer to a language server protocol than to AST parsing or call-graph construction. Gecko argues this is what makes the analysis hold up on microservice architectures and on dynamic languages, and quotes a false positive rate of roughly 20%.
A scan produces three things: findings, each carrying a complete source-to-sink call chain, a CVSS severity, a proof of concept and a ready-to-apply patch; an AI-written repository wiki covering architecture, routing and the security model; and a map of the application's endpoints.
Five capabilities are put forward. Threat Modelling works at the level of each service and each release cycle. Accurate Indexing is the graph described above. Natural Language Rules lets a team write a security policy in ordinary language and have it enforced across code, dependencies and the connected environment. CI/CD Scanning moves the analysis into the pipeline, with a bot on pull and merge requests. Contextual Scanning reaches across repositories and microservices, targeting the problems that only surface between trust boundaries.
Coverage is compiler-accurate for TypeScript, JavaScript, Python, Go, Java, Scala, C# and Rust, with general support for Ruby, PHP, C, Swift and others. The default deployment is cloud, the application running on Vercel and the scanner in Gecko's AWS environment; Enterprise customers can switch to a hybrid model where the scanner runs inside their own AWS account and only findings travel back.
The home page advertises eight times more true positives, 90% fewer false positives and a one-hour average remediation time, alongside a testimonial from Jon Raper, CISO at Chevron, on business logic flaws and multi-step attack chains. Gecko targets teams from Fortune 500 companies to startups and says it learns from user feedback to sharpen its accuracy over time.
What it does
- Connect a GitHub or GitLab repository, a public repository URL or a ZIP upload, and scan it.
- Run a deep multi-repository scan, a fast pull request check, or schedule recurring scans.
- Receive findings with the full source-to-sink call chain, a CVSS severity, a proof of concept and a ready-to-apply patch.
- Prioritise the issues Gecko can prove are genuinely exploitable remotely, and block risky merges.
- Fix in one click through an auto-fix pull request, then rescan to verify the correction.
- Write security rules in plain English and enforce them across the whole codebase.
- Push validated findings to Jira, Linear, ClickUp or Shortcut, and notify the team on Slack.
When to use Gecko Security / When not to
A quick filter to help you decide if Gecko Security is the right fit.
When to use Gecko Security
- Product and engineering teams that ship continuously without a dedicated application security engineer on staff.
- Microservice and multi-repository architectures, where the real problems only appear between trust boundaries.
- Codebases written in dynamic languages such as Python, Ruby, PHP and JavaScript, which classic AST-based analysis covers poorly.
- Security teams buried under false positives from an existing SAST: the vendor claims 90% fewer false positives and eight times more true positives.
- Audited organisations (SOC 2) that must trace scans and remediation, and teams that refuse to let code leave their own cloud thanks to the Enterprise hybrid deployment.
When not to use Gecko Security
- Teams hoping to replace human security expertise: the terms of service require the customer to keep qualified human security personnel to validate every output.
- Buyers expecting exhaustive coverage or a guarantee: the terms state that the product will not identify all vulnerabilities, will not be error-free, and offers no protection guarantee against an incident, a leak or a cyberattack.
- Teams whose code lives on Bitbucket or Azure DevOps: only GitHub and GitLab connectors are documented, alongside a public URL or a ZIP upload.
- Anyone looking for a mobile app or a browser extension, and anyone under 18: this is a web product with an API and CI/CD bots, restricted to adults by the terms.
- Occasional users hoping to run continuous security on the free tier, which is capped at 10 scans.
How to use Gecko Security
A typical end-to-end flow, from setup to results.
- Create an account on app.gecko.security; the free tier is reachable without talking to a salesperson.
- Connect a code source: a GitHub App for GitHub.com, a token for GitHub Enterprise Server, an access token for GitLab.com, or a service account with a personal access token for self-managed and Dedicated GitLab.
- On IP-restricted instances, allowlist the fixed set of addresses Gecko connects from; GitHub.com and GitLab.com need no network change.
- Without a connector, point Gecko at a public repository URL or upload a ZIP archive instead.
- Launch a scan: a deep, multi-repository pass, or a fast check on a pull request. Scans can also be scheduled.
- Triage the findings by confidence, severity, call chain and status lifecycle.
- Apply the fix: open a one-click auto-fix pull request, then run a verification rescan.
- Configure the other integrations in Settings, connecting the code source first.
- Write custom rules in natural language, available on the Pro tier.
- Set up administration: identity model, roles and permission matrix, SAML/OIDC SSO with SCIM, API keys, audit log and the Billing page; connect Claude, Claude Code, ChatGPT, Codex or Cursor over MCP, with permissions capped by each user's role.
Pros & Cons
Pros
- Semantic analysis instead of pattern matching, which surfaces business logic flaws and multi-step attack chains a signature-based scanner cannot see.
- Exploitability is verified before an issue is reported, which cuts the noise; the vendor claims eight times more true positives, 90% fewer false positives and a one-hour average remediation time.
- The fix comes with the diagnosis: a ready-to-apply patch and a one-click auto-fix pull request, not just a ticket.
- A genuinely permanent free tier (10 scans, CI/CD bot, autofix, smart prioritisation), with no credit card announced.
- Multi-repository and microservice coverage, where isolated scanners fall short, plus an Enterprise hybrid option that keeps the code inside the customer's own cloud.
- A contractual clause forbids training Gecko's models on Customer Content; SOC 2 compliance is claimed, with a public trust centre and annual third-party audits.
- Numerous triage integrations (Jira, Linear, ClickUp, Shortcut, Slack, DefectDojo) and MCP connections to the developer's own AI agents.
Cons
- The performance figures (eight times more true positives, 90% fewer false positives, one-hour remediation, around 20% false positives) are self-declared, with no published methodology or benchmark; the 20% figure is explicitly based on customer testimonials and industry benchmarks.
- The Service Data licence is very broad: perpetual, irrevocable, sublicensable and transferable, for any commercial purpose.
- No data hosting country or region is published, and no configurable training opt-out is documented: the ban on training is contractual, not a setting the customer can toggle.
- Code sources are limited to GitHub and GitLab; neither Bitbucket nor Azure DevOps is documented.
- A single contact channel, gecko@gecko.security, with no phone number and no form; the trust centre cannot be read without JavaScript rendering, so the subprocessor list it announces is not directly legible.
- A wide gap between Pro (100 USD per month, capped at five team members and 100 scans a month) and Enterprise (custom quote, annual billing only), with SSO/SCIM, audit logs and hybrid deployment reserved for Enterprise.
- A young company, with the domain registered in 2024 and two employees listed by Y Combinator, and no Article 27 GDPR representative named even though the vendor explicitly addresses the EU and the UK.
Pricing & Plans
Gecko Security operates on a freemium model. A permanent free plan, not a time-limited trial, provides 10 scans, CI/CD integration with a pull and merge request bot, Gecko's AI SAST, pull request reviews with one-click autofix and smart prioritisation. The lowest paid entry point is the Pro plan at 100.00 USD per month, which adds 100 scans a month, team management for up to five members, the Gecko API, Jira, Linear and Slack integrations and custom rules. Enterprise is quoted on request and billed annually only. Fees are stated in United States dollars and exclusive of taxes. Subscriptions renew automatically, with 30 days' notice required for non-renewal; fees are non-refundable except where a stated termination right provides for a pro-rated refund, and unpaid amounts accrue interest at 1.5% per month. The in-product Billing page shows the current plan, scan usage (used, limit, remaining) and the number of members.
- 10 scans
- CI/CD integration with a pull and merge request bot
- Gecko's AI SAST
- pull request reviews with one-click autofix
- and smart prioritisation. Documented as the tier for evaluating the tool and scanning a few repositories.
- everything in Free
- plus 100 scans per month
- team management for up to 5 members
- the Gecko API
- Jira
- Linear and Slack integrations
- and custom rules. Documented as the tier for teams that want notifications
- API access and continuous scanning.
- everything in Pro
- plus unlimited scanning
- on-prem
- self-hosted or private cloud deployment
- SSO/SAML with SCIM
- dedicated account management
- audit logs and priority support. Documented as the tier for organisations that need SSO/SCIM
- audit logs and hybrid deployment.
Data, GDPR & hosting
A consolidated view of how Gecko Security handles your data.
GDPR overview
The privacy policy carries a dedicated EU/UK Data Protection section, so the implementation is concrete rather than declarative. Gecko acts as controller for its own operational functions (account management, responding to requests). The legal bases are listed: contractual necessity, legal obligation, legitimate interests, consent, and the defence of legal claims. Rights of access, rectification, erasure, restriction, objection and portability are set out, and consent can be withdrawn at any time by writing to gecko@gecko.security. Transfers outside the EEA and the UK rely on standard contractual clauses, adequacy decisions or other mechanisms, with a copy available on request. Complaints can be filed with the local supervisory authority, and links to the EDPB and the ICO are given. A DPA is mandatory before submitting GDPR personal data. No Article 27 EU representative and no DPO is named.
Who owns the data?
Under the terms of service the customer keeps every right to its Customer Content and explicitly owns the Outputs the platform generates. Gecko only receives the licence it needs to copy, display, modify and use that content to deliver the product. The exception is Service Data: the customer grants Gecko a perpetual, irrevocable, worldwide, royalty-free, sublicensable and transferable licence to use it for any commercial purpose, without restriction or obligation. Feedback is supplied as is and Gecko may reuse it freely. On termination, Customer Content is deleted within 30 days and the customer has 14 days to retrieve its Outputs.
Reuse rights
Version 2.0 of the privacy policy, effective 28 April 2026, lists the personal data collected: name, email address, phone number, company, online identifiers such as IP address, plus whatever the user submits. Non-personal data is gathered automatically, including browser type, referring and exit pages, date and time. The stated purposes are operating and maintaining the service, improving and personalising it, answering requests, analysing usage, developing new features, sending newsletters with consent, preventing fraud, enforcing the terms, defending legal rights and meeting legal obligations. Customer Content is contractually barred from being used to develop, train or enhance Gecko's artificial intelligence or machine learning models, including third-party components of the product, except for the customer's sole benefit. The service does run on named third-party LLMs from OpenAI and Anthropic, whose own terms bind the customer, and a data processing agreement must be signed before any GDPR-covered personal data is submitted. Because Outputs belong to the customer, they can be reused, shared internally and acted upon without asking Gecko for permission.
Data retention & training
Hosting summary
No hosting country or region is named anywhere on the site. In the default cloud model the application runs on Vercel and the scanner runs in Gecko's own AWS environment. Enterprise customers can choose a hybrid model in which the scanner runs inside the customer's AWS environment: the code is retrieved from the customer's own account, for example from S3, analysed locally, and only the findings travel back to the dashboard. The site's FAQ also mentions support for private AI models and self-hosted deployments so that vulnerability data and source code stay under the customer's control, and on-prem, self-hosted and private cloud options are listed on the Enterprise tier. For personal data, the privacy policy allows transfers outside the EEA and the UK, framed by standard contractual clauses or an adequacy decision. The site's public IP address resolves to AS16509 Amazon.com through an anycast node, but that is a network fact about the marketing site, not a statement about where customer data is stored. In short, the deployment topology is documented; the jurisdiction is not.
Things to keep in mind
Risks and trade-offs to weigh before adopting Gecko Security.
- The terms require the customer to keep qualified human security personnel to review each output before acting on it. Treating a clean scan as proof of safety, and letting in-house security judgement erode, is the most likely misuse of the tool.
- The terms state in capital letters that the product will not identify all vulnerabilities and will not be error-free. There is no guarantee against an incident, a leak or a cyberattack, Gecko excludes liability for damage tied to an undetected flaw, and liability is capped at the fees paid over the previous 12 months.
- The Service Data licence granted to the vendor is perpetual, irrevocable, sublicensable and transferable, for any commercial purpose, with no restriction or obligation.
- A data processing agreement must be signed before submitting any personal data covered by the GDPR, not afterwards.
- The service sends content to third-party LLMs, OpenAI and Anthropic, whose terms bind the customer and can change without notice; that list is not exhaustive and can be extended at Gecko's discretion.
- No hosting country is published: the application runs on Vercel and the scanner in Gecko's AWS environment. Disputes go to mandatory JAMS arbitration under Delaware law before the courts of New Castle County, and the subscription auto-renews unless cancelled 30 days in advance.
- Gecko may use the customer's name and logo in its marketing, and the contractual notice address in London differs from the company's postal address in Florida depending on which document is read.
Setup & Integrations
Technical difficulty
Low on the standard path: Gecko advertises connecting a repository and reviewing real findings in minutes. GitHub.com only needs a GitHub App install and no network change, GitLab.com an access token. Self-managed setups, GitHub Enterprise Server or self-managed and Dedicated GitLab, need a service account with a PAT and, on IP-restricted instances, allowlisting a fixed set of Gecko addresses. Repository administration rights are required. Advanced configuration (natural language rules, scheduled scans, ticket integrations, webhooks, Enterprise SSO/SCIM) is optional, and hybrid deployment is set up with Gecko's team rather than self-served.
Deployment
Integrations
Supported languages
Behind Gecko Security
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
How does Gecko Security work?
How is it different from other security tools?
Which programming languages are supported?
Is there a free plan?
Is my code used to train AI models?
Can our code stay inside our own cloud?
Which code sources can be connected?
Which tracking integrations and APIs are available?
Is Gecko Security SOC 2 compliant?
How long is data kept?
Should you pick Gecko Security?
Gecko Security positions itself as a new-generation SAST: instead of matching patterns, it builds a compiler-accurate graph of the codebase and only reports an issue once its agent can prove the path is exploitable. That verification step is the whole argument, and it is what should cut the noise that makes traditional scanners easy to ignore. The second strength is that the tool does not stop at a diagnosis: every finding arrives with a call chain, a proof of concept and a ready-to-apply patch, and a single click opens an auto-fix pull request. On microservice architectures and dynamic languages, where isolated scanners struggle, this is a real differentiator.
The reservations are just as clear. The headline metrics (eight times more true positives, 90% fewer false positives, one-hour average remediation, roughly 20% false positives) are self-declared, with no methodology or benchmark published. No data hosting country or region is disclosed. The Service Data licence granted to the vendor is perpetual, irrevocable, sublicensable and transferable for any commercial purpose. And this is a young company, founded in 2024, part of the Y Combinator Fall 2024 batch, with a small team in London.
The tool is a sensible fit for development and security teams that want security handled inside the delivery flow rather than as an audit at the end. The permanent free tier makes an honest evaluation possible before any commitment, then Pro at 100 USD per month and Enterprise on quotation. Before adopting it, verify three things on your own data: whether the false positive rate holds up on your codebase, whether the Service Data licence is acceptable to your legal team, and whether the absence of a published hosting jurisdiction is compatible with your compliance requirements.
- Choosing a selection results in a full page refresh.
- Opens in a new window.