Claude Security

What it is

Claude Security scans your codebase for vulnerabilities and proposes targeted patches. It’s built to find the things traditional scanners miss — issues that span multiple files, data flows across components, logic-level flaws that need context to spot.

It’s in public beta on Enterprise plans. Scans run on Claude Mythos 5. When you’re ready to patch, you pivot from a finding directly into a Claude Code session to review and apply the fix.

Where to find it

An organisation owner turns it on with the Claude Security toggle in Organization settings. After that, run and review scans at claude.ai/security.

Claude Security works against repositories hosted on GitHub.com and on GitHub Enterprise Server. Other hosting providers aren’t supported.

How to use it

Run a scan

Point Claude Security at a GitHub repository your organisation owns.
It scans in parallel, tracing data flows across files.
Each finding is verified before it reaches you.

Read a finding

Every finding carries the same fields:

Title and Details — what the issue is and the technical story behind it.
Location — file path and line number.
Impact and reproduction steps — what an attacker could do, and how.
Recommended fix — outcome-based guidance rather than a literal patch.
Severity, Status, Category, Repository, Branch, and the date it was created — plus a dismissal reason and notes if someone has dismissed it.

Pivot to a patch

From a finding, open a Claude Code session.
Claude proposes a fix. Review it.
Apply, test, commit.

Good to know

Severity is per-finding, not per-category. The same class of issue can be High in one codebase and Low in another, because the rating is about exploitability in your code.
- High — exploitable by an unauthenticated remote attacker against a default deployment, with no meaningful preconditions.
- Medium — requires authentication, or one or two realistic preconditions.
- Low — three or more preconditions, local-only access, or no demonstrated attack path.
Severity is not configurable.
Scans are stochastic. A real issue may not surface on every run, so scan regularly rather than treating one clean run as proof.
Pricing is direct token cost only — there’s no additional platform fee. Patches open in Claude Code and use the models available to your account.
No Zero Data Retention option is available for Claude Security.
Scope of use. You may only scan code your organisation owns and has the rights to scan.

What’s changed recently

2026-09-13 — Re-read against the help-centre article. Claude Security is now described as a public beta for Enterprise plans rather than a research preview, and it has a home of its own at claude.ai/security, switched on by an owner under Organization settings → Claude Security. GitHub Enterprise Server is now supported alongside GitHub.com. Scans run on Claude Mythos 5 — previously we noted Mythos was limited to a small set of approved customers, which the article no longer says. Pricing is stated as direct token cost with no platform fee, and there is no Zero Data Retention option. The finding schema is documented in plainer terms than the JSON-style field list we had, so that list has been rewritten.