Claude Security scans repositories as the code changes

Anthropic's 21 October 2026 post updates Claude Security, in public beta for Claude Enterprise. After a deep baseline scan, it scans later changes based on their risk and complexity, so the findings stay closer to the current code. Repositories connect through the Claude GitHub app, including GitHub Enterprise Server, or with an access token from GitLab and other Git providers. A project can hold more than one repository, which Anthropic says lets it catch issues that sit between services.

When a fix lands, Claude Security checks open findings against the changed code and marks them fixed, whether the patch was written in Claude Code or somewhere else. If the issue shows up again, the finding reopens. Each project has a knowledge base for how the code is deployed and which policies apply, and Claude generates a threat model the team can edit. Findings include a severity rating against that model and an explanation of how an attacker could reach the code.

A new API can list and update projects and findings, and webhooks can fire when a finding is added. The same tool is an MCP connector in Claude.ai and Claude Code. Admins get roles for who can view, triage, and create projects. Anthropic says organizations receive $25,000 in usage credits each month for two months, through 31 December 2026. The post says Cyber Verification Program access is not required, and that the product uses the full Claude model family, including Claude Mythos. Since the April public beta, Anthropic says thousands of organizations have used it to find over a million vulnerabilities.

Who it's for: a Claude Enterprise team that wants repository findings to move with the commits, and to open a finding in Claude Code.

Fits: Best for Vibe Coding. Claude Code stays second, and Copilot stays fourth. This is a security scan for Enterprise, beside the editor agent. The verdict is unchanged.