Gecko Security

Gecko Security is a Y Combinator-backed application security company that offers an AI-native static application security testing (SAST) platform. The platform analyzes source code, application logic, and infrastructure to identify exploitable vulnerabilities, with a focus on business logic flaws and multi-step attack chains that traditional pattern-matching tools typically miss. Rather than relying on abstract syntax tree (AST) parsing or call graph analysis, Gecko uses semantic name bindings similar to a language server protocol to build a compiler-accurate graph of a codebase. This approach enables more precise detection across dynamically typed languages and microservice architectures by tracing data flows and trust boundaries across multiple repositories and services. Key capabilities include: - Threat modelling scaled across services and release cycles - CI/CD pipeline integration with pull/merge request bot reviews and one-click autofix - Natural language security policy rules applied across code, dependencies, and connected environments - Contextual scanning across multiple repos and microservices - Integrations with Jira, Linear, Slack, Bitbucket, Azure, and Terraform The platform is designed for development teams and security-conscious enterprises. It offers a free tier with 10 scans, a Pro tier at $100/month for growing teams, and a custom Enterprise tier with unlimited scanning, on-premises/self-hosted deployment options, SSO/SAML with SCIM provisioning, and audit logs. Gecko is SOC 2 compliant and supports private AI models and self-hosted deployments to keep source code and vulnerability data under customer control. Customers include teams from Fortune 500 companies and startups.