Claude Security tracks fixes: follow findings into the code

On October 21, 2026, Anthropic announced an update to Claude Security, available in public beta to Claude Enterprise customers. It starts with a baseline scan, continues checking as code changes, and tracks whether findings have been addressed by actual code changes.

Once a fix lands, the system checks the changes. If it later finds the same issue again, the finding reopens. Teams can also add deployment context and inspect or edit the project's threat model: a description of how the system might be attacked, used to inform scanning. Continuous scanning and project context

Suppose a team has a proposed fix for an access-control issue, but the code is still under review. Having a patch does not mean the scanned branch is fixed. Tracking connects the finding with later code changes, helping the team check whether the fix has actually entered the scanned scope.

Open a finding's Evidence to check the file, line, branch and commit. Use History to inspect status changes. If the analysis missed a deployment condition, explain it in the project conversation and ask for the threat model to be updated. Evidence and environment context This is a suggested checking workflow; the team still needs to assess scan results.

You need an active Claude Enterprise organization, an eligible Claude Code seat and usage-based billing enabled. For Standard/Premium seat plans, the help center requires Premium. An administrator must enable Claude Security and allow you to create projects. Scans are billed by token usage, with a separate spending limit available. Connect only code that you or your company have the rights to scan. Access and billing requirements

1. For GitHub repositories, an administrator first installs the Claude GitHub App and grants access to the intended repositories; users connect their own GitHub accounts. Other Git services require a repository URL and authentication token. Open claude.ai/security, click New project, and name it. Preparation and entry point
2. Add the repository and check the branch, folder scope and excluded directories. Add architecture or deployment information if needed. Click Create project and wait for the baseline scan. It can take minutes to hours; you can leave and return later. Create and scan a project
3. Inspect an issue in Findings. Fix opens Claude Code to work on it. If Claude Code on the web is not enabled, copy the prompt into your own Claude Code. Review the changes and merge them into the target code through your team's process; starting a fix is not completing one. The fix workflow
4. Return to the finding and check its status and code evidence. A fixed issue that returns after later changes automatically reopens. Inspect the new changes instead of merely closing the finding. Tracking behavior