Gecko Security: Product, team and how it was built
Gecko Security (AI code scanner for security flaws, United Kingdom): Paid Pro plan on sale, November 2026. Evidence grade E: no revenue figure was checked. Team: 2 founders; Y Combinator lists a team of 2; headcount today not published. Launched October 2024; still running.Added
- Outcome
- Paid Pro plan on sale, November 2026
- Evidence
- E no revenue figure was checked
- Launch
- October 2024
- Status
- Still running
- Team
- 2 founders; Y Combinator lists a team of 2; headcount today not published
- Outside funding
- Y Combinator Fall 2024 and five other named investors; amounts not stated
- Main channel
- Not stated
What is not verified
No revenue figure was found. The pages read were the company's site, its blog, the Y Combinator pages and a Hacker News thread. No payment-processor profile, filing or interview with revenue was found. The pricing page shows a self-serve Pro price with a button to the web app, and the terms describe automatic card charges. No independent source states that a customer has paid. The customers are the company's own statement. This story is grade E: the business is real and its product, price and customers are described from public pages, but no revenue figure was checked. Aiolum shows it as an idea worth studying, not as proof that it makes money.
Gecko Security sells a scanner for business-logic vulnerabilities. These are flaws in what a program lets a user do, for example reading another user's data by changing an ID. The scanner is a form of static analysis (SAST), which reads source code without running it, and it uses large language models. The company's pages say each finding comes with a call chain from input to the flawed code and a working proof of concept.
Jeevan "JJ" Jutla is CEO and Artemiy Malyshau is CTO, as the company's about page lists them. The Y Combinator company page says the company was founded in 2024, in the Fall 2024 batch, with a team of 2 in London. In October 2024 the company's site offered AI testing together with human hackers at a fixed price. In November 2026 its pricing page lists a free trial, a Pro plan and a custom Enterprise plan.
No revenue figure was found, so this story has grade E. The best-supported facts are the self-serve paid plan on the pricing page and the founder's claim of 30+ CVEs found in open-source projects. No independent source states that a customer has paid.

Why did Gecko Security work?
Four causes, in the order they mattered. Each one is a reusable lesson.
The founders built the scanner from their security careers
The about page says one founder worked at GCHQ and on a Binance red team. It says the other served in the Austrian Cyber Forces and worked on security projects for Interpol. The founder wrote on Hacker News that they saw the limits of older scanners in these careers.
It publishes write-ups of flaws found in open-source projects
The blog has 47 articles, including CVE write-ups. The two n8n posts describe the flaw, a proof of concept and a patched version, and link a GitHub advisory. The founder wrote on Hacker News that the company notifies maintainers and publishes after a fix. No source says how many customers these posts brought.
The offer moved from fixed-price testing to a scanner with a trial
In October 2024 the site sold unlimited testing with human hackers at a fixed price. In 2025 the founder described a free tier of one scan per user. In November 2026 the pricing page lists 10 trial scans and a self-serve Pro plan.
How it was built
These details come from the founder's Launch HN post and the company's pages. They are grade C. [7, 12, 1, 2]
- A custom indexer reads code like an IDE, inspired by GitHub's stack graphs. The founder wrote that it stores symbols and references in a compact Protocol Buffers format.
- A language model builds a threat model from the developer's intent, the trust boundaries and the exposed endpoints. It then proposes attack paths.
- For each path the system asks the indexer for the code it needs and rebuilds the call chain from source to sink. A Monte Carlo Tree Self-refine algorithm scores the path.
- The founder wrote that the system does not feed whole codebases to the model. The terms of service name OpenAI and Anthropic as third-party model providers.
- The company's site is a Next.js application with content on Sanity, as its page source shows. The about page says scans run in short-lived sandboxes and that code is not stored.
Tools named in the sources
Each one opens its page in the Tools tab, with every story that uses it.
Who tried this before Gecko Security, and why did they fail?
Two companies in our database of failed startups sold code analysis or code understanding to engineering teams. The values below are from that database and are not independently verified.
Sider
The promiseAutomated code review and static analysis for software teams, to catch bugs and security flaws before production.
Why it diedThe record says free open-source tools and larger platforms that bundle code analysis left little room for a separate product.
CodeSee
The promiseAutomatic visual maps of code architecture and dependencies for developers.
Why it diedThe record says the company struggled to turn free users into paying customers and compares its product to a vitamin, not a painkiller.
The failed startups come from our database of 1,749 dead startups, retold here in our own words. Its entries are AI-assisted summaries of public sources, so these cards carry no evidence grade.
What changed
Both companies sold understanding of code to developers who could get something similar for free. Sider faced free open-source analyzers and larger platforms. CodeSee, the record says, could not convert free users.
Gecko Security sells a narrower result: exploitable flaws with a proof of concept. Its pricing page lists a flat US$100 per month for the Pro plan. Whether customers pay for that result is not shown by any independent source. The founder's own claim is several enterprise customers.
Can one person copy Gecko Security now?
The structure, yes. The founders' background, no.
A narrow scan that returns proof, not a long list, can be sold with a trial and a flat monthly price. The founders' intelligence and cyber careers are the part that is hard to copy.
Where it is still open: Other checks that need reasoning over a whole codebase, such as license risks, data-flow privacy checks and access-control reviews.
- 1Pick one class of flaw that older tools miss, and show it on public code.
- 2Let a buyer scan a real repository before paying.
- 3Publish each finding with the advisory and the fixed version.
- 4Add a self-serve plan for small teams and a custom plan for large ones.
How much revenue does Gecko Security make?
Each row shows the evidence grade and the source numbers from the list at the end of this page. The grades are explained in How Aiolum verifies.
| Fact | Value | Grade | How we know | Sources |
|---|---|---|---|---|
| Company start | 2024 | C | The Y Combinator company page reads Founded: 2024, Batch: Fall 2024. The company's site footer carries no year of founding. | [4, 1] |
| Earliest site copies | 31 March 2024 and 8 October 2024 | C | The Internet Archive's first copy of the home page, of 31 March 2024, shows the name Gecko Security and the words Coming Soon. The copy of 8 October 2024 offers an AI security engineer plus expert human hackers at a fixed price. Neither copy names an earlier company name. | [15, 13] |
| Founders | Jeevan "JJ" Jutla (CEO), Artemiy Malyshau (CTO) | C | The company's about page. The page says one joined GCHQ as a teenager and the other served in the Austrian Cyber Forces. | [2] |
| Team size | 2 on the Y Combinator page; headcount today not published | C | The about page shows the two founders and says the company is growing. It gives no headcount. | [4, 2] |
| Backers named by the company | Y Combinator, Z Fellows, Ritual Capital, Rebel Fund, Liquid 2, Garage Capital | C | The about page. It states no amounts and no dates. It also names advisors from four large companies. | [2] |
| Paid plan on sale | Pro, US$100 per month | C | The pricing page, November 2026. The terms of service describe a recurring payment feature that automatically charges the card on file. | [3, 12] |
| Free trial | 10 scans in total, November 2026 | C | The pricing page. In July 2025 the founder wrote on Hacker News that the free tier was limited to one scan per user. | [3, 7] |
| Vulnerabilities found in open-source projects | 30+ CVEs | C | The founder's Launch HN post of 31 July 2025 names Ollama, Gradio and Ragflow. A CVE is a public identifier for a disclosed flaw. | [7, 5] |
| Customers, as stated by the founder | several enterprise customers; 50% fewer false positives on the same codebases | C | Launch HN post, 31 July 2025. The post names no customer. | [7] |
| Customer story on the company's blog | Cal.com, 27 August 2026 | C | Published by the company. It quotes the Head of Engineering and the CEO of Cal.com. No payment is stated. | [10] |
| Third-party models named in the terms | OpenAI and Anthropic | C | The terms of service say the services rely on third-party large language models and list those two providers. | [12] |
| Time from the launch post to the November 2026 plan | 25 months | calc | Calculated: October 2024 to November 2026. | [6, 3] |
How to read this table. Grade C is a statement by the company or its founders. A grade E story has no dated money figure, so no row here is a revenue number. A "calc" value was computed on this page.
| Plan | Per month, billed yearly (US$) | Per month, billed monthly (US$) | Limit |
|---|---|---|---|
| Free Trial | 0 | 0 | 10 scans in total, deep scans or pull request checks |
| Pro | 100 | 100 scans per month; team management for up to 5 people | |
| Enterprise | custom, annual billing | unlimited scans; single sign-on, audit logs and on-premise deployment |
The page lists Pro at US$100 per month and Enterprise as custom annual billing set by the size of the engineering organization. The trial is described as a trial, not a permanent free tier. The Pro button leads to the company's web app, which was not opened.
When did Gecko Security launch, and how did it grow?
From a Y Combinator batch in 2024 to a self-serve scanner with a paid plan in 2026. Each entry carries its grade.
- 2024CFounded, as the Y Combinator company page states, in the Fall 2024 batch. [4]
- 8 October 2024CThe company's home page offers continuous vulnerability detection by an AI security engineer and expert human hackers, at a fixed price by organization size. [13]
- 16 October 2024CThe first Y Combinator launch post, dated by its page data, says all testing runs in parallel with certified human pentesters. [6]
- 31 July 2025CLaunch HN post by the CEO: a static analysis tool with large language models, 30+ CVEs claimed and several enterprise customers. [7, 5]
- 22 April and 13 May 2026CThe CTO publishes two write-ups of flaws in n8n, each linking a GitHub advisory with patched versions. [8, 9]
- 27 August 2026CA customer story about Cal.com appears on the company's blog. [10]
What could go wrong for Gecko Security?
The risks are the mirror image of the causes above.
What is not verified
No revenue figure was found. The pages read were the company's site, its blog, the Y Combinator pages and a Hacker News thread. No payment-processor profile, filing or interview with revenue was found. The pricing page shows a self-serve Pro price with a button to the web app, and the terms describe automatic card charges. No independent source states that a customer has paid. The customers are the company's own statement.
Logo wall, quotations and counters
The home page shows six customer names, one unnamed "Fortune 500 Financial Institution" and three quotations. One is from a named CISO of Chevron. One is from an unnamed "MD of Security" at a financial institution. The about page lists Chevron among the companies of its advisors. No source here confirms that these names pay. The quotations were not searched for copies elsewhere.
Security research on other projects
Most blog posts read describe flaws in open-source code, such as n8n, and link advisories with patched versions. The founder wrote that the company scans public repositories, notifies maintainers first and publishes after a fix. A post of 26 January 2026 says the scanner found flaws "in Cal.com Cloud", the hosted service of a codebase that was open source at that time. The post shows the source code, thanks the security team of Cal.com and says the fixes shipped within a few days of the report. It does not say whether the flaws were tried on the hosted service, or with what permission. Cal.com later appears on the blog as a customer.
Claims and changes
The 30+ CVE count, the false-positive figure and SOC 2 compliance are the company's statements and were not checked. The founder's July 2025 post said the free tier was one scan per user. The November 2026 page says 10 scans. The 2024 offer included human pentesters.
Sources
The grade next to each source is the best grade that the source can support. "Read in full" means that the text of the page was downloaded and the numbers were checked in it.
- C Gecko Security home pageRead in full, 12 November 2026. Source for the product description, the logo wall and the three quotations. The page source shows Next.js and Sanity.
- C Gecko Security about pageRead in full, 12 November 2026. Source for the founders, the named backers and advisors, and the sandbox claim.
- C Gecko Security pricing pageRead in full, 12 November 2026. Source for the three plans, the Pro price and the 10 trial scans.
- C Y Combinator company page: Gecko SecurityRead in full, 12 November 2026. Source for the year founded, the batch, the team size of 2 and the location.
- C Y Combinator launch post, 2025: Gecko Security: AI SAST for finding Vulnerabilities in CodeRead in full, 12 November 2026. The post data is dated 4 August 2025. Source for the 30+ CVE claim and the customer claim.
- C Y Combinator launch post, 2024: Gecko Security: Your AI Security EngineerRead in full, 12 November 2026. The post data is dated 16 October 2024. Source for the early product with human pentesters.
- C Hacker News, 31 July 2025: Launch HN: Gecko Security (YC F24) - AI That Finds Vulnerabilities in CodeRead in full, 12 November 2026. The CEO's post and his replies. Source for the method, the CVE claim, the free tier and the disclosure practice.
- C Gecko Security blog, 22 April 2026: CVE-2026-42227: n8n Public API Variables IDOR Allows Cross-Project Secret DisclosureRead in full, 12 November 2026. Source for the advisory link, the patched versions and the proof of concept on a test instance.
- C Gecko Security blog, 13 May 2026: n8n Cross-user Authorization Bypass in Dynamic Credential OAuth EndpointsRead in full, 12 November 2026. Source for the second advisory and its patched versions.
- C Gecko Security blog, 27 August 2026: How Cal.com Rebuilt AppSec After Going Closed SourceRead the opening sections only. A customer story published by the company.
- C Gecko Security resources pageRead in full, 12 November 2026. Source for the count of 47 articles and the list of recent posts.
- C Gecko Security terms of serviceRead the payment and third-party model passages. Source for the recurring charge and the model providers.
- C Internet Archive copy of the Gecko Security home page, 8 October 2024Read in full, 12 November 2026. Source for the earlier offer with human hackers at a fixed price.
- C Database of failed startups, local exportRecord pages read on the website on 12 November 2026. AI-written summaries, not independently verified. Source for the failed predecessors.
- C Internet Archive copy of the Gecko Security home page, 31 March 2024Read in full, 12 November 2026. The first copy the archive lists for the domain. It shows only the name and Coming Soon.
- C Gecko Security blog, 26 January 2026: How Broken Access Controls in Cal.com Leaked Millions of Bookings and Enabled Complete Account TakeoverRead in full, 12 November 2026. Source for the Cal.com Cloud findings, the report to Cal.com and the fix in version 6.0.8.
Run this company? Send corrections or a verified figure to aiolum@livyden.com