Claude Security now scans continuously and tracks fixes

Claude Security is Anthropic's security scanner, and this update changes it from something you run on demand into something that watches your code. You connect repositories through the Claude GitHub app (including GitHub Enterprise Server) or a GitLab or other Git access token, pick branches and scope per repo, and Claude runs a deep baseline scan. After that it rescans changed code on a schedule based on risk and complexity, so the findings list tracks the current state of the codebase rather than a snapshot from last month. A single project can span several repositories, which matters for bugs that sit between services, such as a backend trusting input a frontend was supposed to validate. The tool also now closes its own loop: when a fix lands, whether it came from Claude Code or some other process, open findings tied to the changed code get marked fixed, and they reopen automatically if the issue shows up again. The other substantive change is that each project gets a knowledge base and an auto-generated threat model. Your team describes how the code is deployed, which security policies apply, and what a new security engineer would need to know. Claude then builds a threat model from the code that you can review and edit, and later scans use it to decide what to flag and what to skip because your environment already handles the risk. Every finding comes with a severity rating judged against that threat model and an explanation of how an attacker could reach the vulnerable code, sometimes with a diagram of the attack path. That reachability focus is the point: you fix what's exploitable first, not whatever scored highest on a generic scale. For integration, there's a new API covering listing and reading projects and findings, resolving or reopening them, and managing projects and repositories, plus webhooks for new findings. Personal access tokens are scoped to whatever the user can already see and change. Claude Security is also available as an MCP connector in Claude.ai and Claude Code, so an engineer can open a finding, ask about it, make the fix, and resolve it in one session. Admins get role-based access controls for viewing projects, triaging findings, and creating projects, which lets them open the tool to code owners without handing everyone project creation rights. The product is in public beta for Claude Enterprise customers, with $25,000 a month in usage credits for two months, covering usage through December 31, 2026. The testimonials are vendor-selected, so treat the claims about finding logic flaws and outperforming a pen test as anecdotal, but the feature set itself is concrete enough to evaluate directly.