Gecko Security

Security that actually understands your codebase, @ycombinator (F24)

[Gecko Security @gecko_sec]

Grab a time with us here: https://t.co/3NSNfVcWcz

[Gecko Security @gecko_sec]

Gecko is coming to #RSAC2026 🦎

Here’s how to find us:

→ Meet the team at Booth #39 in the Early Stage Expo
→ See live demos of the Gecko platform in action
→ Book a 1:1 with our founders to talk about scaling AppSec and where it’s heading

[🇷🇴 cristi @CristiVlad25]

this should be interesting. @BSidesLondon

[Gecko Security @gecko_sec]

The Gecko team is at #BlackHatEurope in London!

Excited to continue great conversations from yesterday tackling SAST and AppSec challenges.

If you’re in London, stop by booth #722 to see how Gecko finds and fixes business logic vulnerabilities at scale.

[Artemiy @nkoorty]

We want to address attribution oversights in several of our CVE disclosures and properly credit the original researchers for those findings.

Earlier this year, we used our AI SAST tool to scan GitHub and find vulnerabilities in open-source repositories. For all findings by Gecko, we worked directly with the maintainers to develop and release fixes. We've since learned that some of our findings had already been discovered first by other researchers on separate bug bounty platforms with one already having a CVE assigned, but no public fix released. At the time of our disclosures, neither we nor the maintainers were aware of any prior reports. We scanned the latest versions of code and only checked GitHub and CNA advisories, not different bounty platforms, which was an oversight on our part.

[Gecko Security @gecko_sec]

@FuzzingLabs @ycombinator @ollama @Gradio https://t.co/Ke7BXxYYTU

[Gecko Security @gecko_sec]

Disappointed to see public accusations without reaching out first, especially after launching a competitive product.

We work directly with maintainers via GitHub, not bounty platforms. Neither we nor the maintainers knew about your Huntr reports at the time, otherwise they would have been marked as duplicates.

We've publicly credited FuzzingLabs for the 2 CVEs where your findings came first, and we're always happy to credit whoever finds them before we do.

The claim about stolen CVEs doesn't hold up when many links you provided were already marked as "duplicate" or "invalid" on Huntr.

[Gecko Security @gecko_sec]

Disappointed to see public accusations without reaching out first, especially after launching a competitive product.

We work directly with maintainers via GitHub, not bounty platforms. Neither we nor the maintainers knew about your Huntr reports at the time, otherwise they would have been marked as duplicates.

We've publicly credited FuzzingLabs for the 2 CVEs where your findings came first, and we're always happy to credit whoever finds them before we do.

The claim about stolen CVEs doesn't hold up when many links you provided were already marked as "duplicate" or "invalid" on Huntr.

[Y Combinator @ycombinator]

Gecko’s (@gecko_sec) AI SAST scanner found 30+ zero-day vulnerabilities in major open source projects that no AppSec tool found.

Here’s how they did it: https://t.co/vYObKNdLKn

[Gecko Security @gecko_sec]

https://t.co/sp4Wexqwkv

[Gecko Security @gecko_sec]

quick recap before christmas of what we shipped:
- js/ts/java support for our ai pentester
- github bot that scans your branch at every pr
- teams feature for companies that want to share scans/vulns
- scan any repo using the github public url
- code fixes for each vulnerabilities (if applicable)
- closed seed round

what have you shipped, anon? 🦎

[Garry Tan @garrytan]

Every piece of software is so absolutely full of bugs I cannot wait for an integrated Blackbox AI tester agent that works with an automatic P2 bug fixer agent to just fix all the most annoying tedious little bugs that PMs will mark as “won’t fix”

The people who do that should win a Nobel Prize for Software

[Garry Tan @garrytan]

This demo is pretty interesting — they find 0 day intrusions. There's a whole world in which they should go find the 0 days that LLMs can find *before* the other LLMs do so

[Gecko Security @gecko_sec]

Try out Gecko here: https://t.co/sp4Wexqwkv

We've also just launched Gecko on Product Hunt, we'd love your support and feedback: https://t.co/Ve8wQ7Uep7

[Gecko Security @gecko_sec]

If AI helps you write your code, why not let AI secure it too?

[JJ @jjjutla]

300mg caffeine mornings =

[Y Combinator @ycombinator]

YC F24's @gecko_sec is an AI security engineer that finds and fixes vulnerabilities in your codebase, helping teams secure code without relying on one-time human pentests that quickly become outdated.

https://t.co/z90wc75i4h

Congrats on the launch, @jjjutla and @nkoorty!

[Gecko Security @gecko_sec]

Super excited to work with Pete - he’s already helped us immensely! 🦎

[Pete Koomen @koomen]

Congrats to @jjjutla and @nkoorty on launching Gecko Security! Gecko uses AI to replace one-off manual security audits with continuous vulnerability detection. These two are the perfect team to solve this problem; they've already racked up impressive accomplishments in security and AI research and just happen to be great full stack builders. Excited to be working with them!

[Gecko Security @gecko_sec]

@easya_app @jjjutla @nkoorty Just getting started 🦎

[Gecko Security @gecko_sec]

@khoanguyen_btc @ycombinator @stxcity 🚀🚀

[Gecko Security @gecko_sec]

@PeaceLoveMusicG 🚀🚀