# Add Puaro secret scanning to your repositories

Puaro is a cloud SaaS secret scanner for pull requests. There are **no agents, CLIs, or self-hosted runners** to install. You connect your Git provider via OAuth and select repositories to scan.

**Sign up:** https://app.puaro.io/sign-up

**Human-readable guide:** https://puaro.io/docs/getting-started

## Prerequisites

- A Puaro account (free early access at https://app.puaro.io/sign-up)
- Permission to install Git integrations on your organization or user account
- For GitHub: org admin or permission to install GitHub Apps on target repos
- For GitLab / Bitbucket: account with access to the groups or workspaces you want to scan (Early Access)

## GitHub (Active)

1. Sign in at https://app.puaro.io/sign-up
2. Create or join a Puaro organization in the dashboard
3. Open **Integrations** → **GitHub** → **Connect**
4. Authorize the Puaro GitHub App for your GitHub org or user
5. Select repositories to scan (or enable all repositories)
6. Open a pull request on a connected repo — Puaro runs a check automatically
7. Optional: connect **Slack** under Integrations for real-time alerts
8. Optional: set policy to **block**, **warn**, or **notify** on findings in repository settings

**Verify:** A Puaro status check appears on new pull requests within a few minutes of connecting.

## GitLab (Early Access)

1. Sign in at https://app.puaro.io/sign-up
2. Open **Integrations** → **GitLab** → **Connect**
3. Complete OAuth authorization for your GitLab group or namespace
4. Select projects (merge requests) to scan
5. Open a merge request — Puaro posts scan results on the MR

## Bitbucket (Early Access)

1. Sign in at https://app.puaro.io/sign-up
2. Open **Integrations** → **Bitbucket** → **Connect**
3. Authorize Puaro for your Bitbucket workspace
4. Select repositories for pull request scanning
5. Open a pull request — Puaro runs a build-aware check

## Slack notifications (optional)

1. In the Puaro dashboard, go to **Integrations** → **Slack**
2. Connect your workspace and choose a channel
3. Alerts include severity, repository, and a link to the finding

## Policies

- **Block:** failing check prevents merge (when your Git provider allows required checks)
- **Warn:** check passes with warnings; finding visible in the PR
- **Notify:** scan runs; alerts via Slack, email, or webhook without blocking

Configure per repository in the Puaro dashboard after connecting.

## What Puaro does not require

- No daemon or agent in your infrastructure
- No modification to application runtime
- No storage of your source code by default (zero code retention policy)

## Related pages

- Integrations overview: https://puaro.io/integrations
- Detection methodology: https://puaro.io/methodology
- Pricing: https://puaro.io/pricing