FHN 
Anthropic has upgraded Claude Security to monitor connected code repositories continuously, helping development teams identify security problems as their software changes.
Instead of relying only on manually started scans, the service checks code changes, tracks previously discovered vulnerabilities, and updates their status when fixes are applied. If a resolved issue appears again, Claude Security can reopen it.
The updated service is available in public beta to Claude Enterprise customers. Anthropic says thousands of organizations have used Claude Security since April, identifying more than one million vulnerabilities. These figures are based on the company’s own reporting.
How Claude Security Finds New Code Vulnerabilities
After connecting their repositories, teams can choose which branches and areas of code they want Claude Security to examine. The service supports GitHub, including GitHub Enterprise Server, as well as GitLab and other Git providers through access tokens.
Claude Security first scans the selected code to establish a baseline. It then checks changes at intervals determined by the risk and complexity of the work, rather than following a fixed schedule.
The tool can also examine multiple repositories within one project. This is useful because security weaknesses sometimes occur when different services interact, rather than within a single file.
For example, one application component may assume that another component has already validated user input. By examining related code, Claude Security can investigate how data moves through the application and identify potential weaknesses.
Its findings include severity ratings based on the project’s threat model, explanations of how vulnerable code might be reached, and, in some cases, diagrams showing the path through the application.
Tracking Fixes and Integrating With Security Teams
Finding vulnerabilities is only the beginning. Developers also need to fix them and make sure the same problems do not return.
Claude Security helps track this process by checking existing findings against updated code. When it detects that a vulnerability has been corrected, it can mark the issue as fixed. If a later scan identifies the problem again, the finding can be reopened.
Teams can also provide additional information about their applications, including deployment details, internal security requirements, and existing protective controls. Claude Security uses this context to help assess which findings are most relevant to the organization.
Anthropic has also added integrations to fit the tool into existing development workflows:
- API access: Allows teams to retrieve findings and manage projects programmatically.
- Webhooks: Sends notifications when new security findings are detected.
- MCP connector: Lets engineers discuss findings and work on fixes through Claude.ai and Claude Code.
- Role-based access controls: Helps administrators manage who can access projects and security findings.
These features can help development and security teams coordinate their work without relying entirely on manual tracking.
However, continuous scanning does not guarantee that every vulnerability will be found. Anthropic notes that results can vary between scans and recommends reviewing proposed fixes before applying them.
Conclusion: Claude Security aims to make vulnerability management an ongoing part of software development. By combining repeated code analysis with fix tracking and integrations, the service helps teams keep security findings aligned with changes to their applications.
About the Author
