Skip to content

Exciting News! Puaro is now part of the Google AI Startups Program

DOCUMENTATION

GETTING STARTED

Connect Puaro to your repositories in minutes. No agents or CLI required.

Start Scanning Free
Machine-readable version (.md)

Add Puaro secret scanning to your repositories

Puaro is a cloud SaaS secret scanner for pull requests and merge requests. There are no agents, CLIs, or self-hosted runners to install. Connect GitHub or GitLab, then select repositories to scan.

Sign up: https://app.puaro.io/sign-up

Human-readable guide: https://puaro.io/docs/getting-started

Prerequisites

  • A Puaro account (free early access at https://app.puaro.io/sign-up)
  • Permission to install Git integrations on your organization or user account
  • For GitHub: org admin or permission to install GitHub Apps on target repos
  • For GitLab.com: access to the groups or projects you want to scan
  • For self-managed GitLab: the instance must be reachable over public HTTPS, plus a personal access token with access to those projects

GitHub (Active)

  1. Sign in at https://app.puaro.io/sign-up
  2. Create or join a Puaro organization in the dashboard
  3. Open Integrations → GitHub → Connect
  4. Authorize the Puaro GitHub App for your GitHub org or user
  5. Select repositories to scan (or enable all repositories)
  6. Open a pull request on a connected repo — Puaro runs a check automatically
  7. Optional: connect Slack under Integrations for real-time alerts
  8. Optional: set policy to block, warn, or notify on findings in repository settings

Verify: A Puaro status check appears on new pull requests within a few minutes of connecting. Optional: open Open fix PR from a finding in the dashboard.

GitLab (Active)

  1. Sign in at https://app.puaro.io/sign-up
  2. Open Integrations → GitLab
  3. For GitLab.com, complete OAuth for your group or namespace
  4. For self-managed GitLab, enter the instance URL and a personal access token. The instance must be reachable over public HTTPS.
  5. Select projects to scan
  6. Open a merge request. Puaro posts results on the MR and can report a commit status and MR notes.
  7. Optional: open Open fix MR from a finding in the dashboard

Bitbucket (planned)

Bitbucket is not available. There is no Connect flow, OAuth install, pull request scan, or status check. Use GitHub or GitLab today.

Slack notifications (optional)

  1. In the Puaro dashboard, go to Integrations → Slack
  2. Connect your workspace and choose a channel
  3. Alerts include severity, repository, and a link to the finding

Policies

  • Block: failing check prevents merge (when your Git provider allows required checks)
  • Warn: check passes with warnings; finding visible on the PR or MR
  • Notify: scan runs; alerts via Slack, email, or webhook without blocking

Configure per repository in the Puaro dashboard after connecting.

What Puaro does not require

  • No daemon or agent in your infrastructure
  • No modification to application runtime
  • No storage of your source code by default (zero code retention policy)

Related pages

  • Integrations overview: https://puaro.io/integrations
  • Detection methodology: https://puaro.io/methodology
  • Pricing: https://puaro.io/pricing