Security scans now keep up with every code change.

01 · What changed

What Anthropic shipped.

Claude Security entered public beta in April, and Anthropic says thousands of organizations have used it to find over a million vulnerabilities. Until this release, someone had to start each scan. Now a project runs a deep baseline scan, then scans changes regularly based on their risk and complexity, so the findings list stays close to the current state of the code. In practice the list works as a live register of open and fixed issues, kept current without anyone scheduling a scan.

1. 1

   Continuous monitoring

   Connect repositories through the Claude GitHub app (including GitHub Enterprise Server) or an access token from GitLab and other Git providers, and choose the branch and scope. After a baseline scan, Claude scans changes regularly based on their risk and complexity.

2. 2

   Multi-repository projects

   A project can hold several repositories. Claude can then catch issues between services, such as a backend that trusts input a client was supposed to validate.

3. 3

   Fix tracking

   Open findings are checked against changed code and marked fixed when the fix lands, whether it was made in Claude Code or elsewhere. If the issue is found again, the finding reopens automatically.

4. 4

   Knowledge base, threat model

   Each project has a knowledge base for how code is deployed, which security policies apply and what a new security engineer would need to know. Claude also generates a threat model your team can review and edit, and later scans use it.

5. 5

   Severity and exploit paths

   Each finding has a severity rating judged against the project's threat model and an explanation of how an attacker could reach the code. Findings can include a diagram of the attack path.

6. 6

   API and webhooks

   The API lists, reads, resolves and reopens findings and creates and manages projects. Personal access tokens see and change only what their user can, and webhooks can notify your systems of new findings.

7. 7

   MCP connector

   Claude Security is available as an MCP connector in Claude.ai and Claude Code. An engineer can pull up a finding, ask Claude about it, start the fix and mark it resolved in one session.

8. 8

   Role-based access

   Admins decide who can view projects, triage findings and create projects. Teams that own code can be given access without the right to create projects.

02 · What it means

What it means for your seat.

For a firm whose engineers build internal tools, such as an investor portal, a portfolio reporting dashboard or an app that reads data room files, this turns vulnerability review from an occasional exercise into a standing record of what was found and whether it was fixed. It is a public beta and only on Claude Enterprise, so the practical question is whether to run it on one set of repositories while the free credits apply.

03 · This week

0 of 3 done

1. 01 · Choose a pilot project and an owner: Pick one set of internal repositories that depend on each other, such as an investor portal and its backend, and put them in one project. Name the person who owns the findings before any repository is connected.
2. 02 · Write the knowledge base and review the model: Describe how the code is deployed and which security policies apply in the project's knowledge base. Then have a security lead review and edit the threat model Claude generates, since later scans use it.
3. 03 · Set roles and route findings: Have an admin enable Claude Security in the admin console and decide who can view projects, triage findings and create projects. Use webhooks or the API to send new findings into the ticketing system your engineers already use.

The short answers.