Claude Security: Who Can Use It, How Scans Work and the Limits

The catch: it's not a Pro or Max feature

If you went looking for Claude Security in your own Pro or Max account and couldn't find it, that's why. Anthropic's help page lists three things you need, as of October 2026: an active Claude Enterprise plan, a premium seat for each user, and usage credits enabled for consumption billing. Miss any one and the feature isn't there.

Even with all three in place, nothing happens until an owner switches it on. That's done in Organization settings > Claude Security. So the first conversation is with whoever owns your Claude organisation, not with your developers. If you're still deciding whether the plan itself is right for your company, my Claude Enterprise guide covers what the plan includes beyond this.

What a scan does

The useful difference from a simple pattern checker is scope. Claude Security scans the codebase as a whole and traces data flows across files and across repositories, so it can follow a value from where it enters your app to where it does damage. Here's what Anthropic says it does:

• Deep Scan. You create a project, connect up to eight repositories, and Claude reads the code, writes a threat model and runs a deep baseline scan.
• Continuous Scanning. New commits get checked as they land, after the baseline.
• Multi-stage verification. Each finding is validated before you see it, to cut down false positives.
• Fixes in Claude Code. You can move a finding into a Claude Code session to generate a targeted fix.
• Automatic re-checks. Open findings are checked against changed code and marked fixed when the problem's gone.

The scans are powered by the Claude Mythos model, and users get the findings without direct access to the model itself.

Projects, repositories and the eight-repo cap

Everything sits inside a project, and a project holds up to eight repositories. Each one is either in scope, which means it's scanned and reported on, or context only, which means Claude reads it during scans but doesn't report findings in it. Both kinds count toward the limit of eight, so a shared library you only add for context still uses a slot.

For hosting, GitHub.com and GitHub Enterprise Server connect through the Claude GitHub App. Other Git servers, including GitLab, Bitbucket and self-hosted ones, connect with the repository address and an auth token.

Each project also keeps one threat model. You tell Claude how the code is deployed, who can reach it and which risks you've already accepted, and Claude uses that to decide what to flag and how to rate it. You edit it on the project's Knowledge tab, and you can add architecture documents there too. I'd treat that tab as the most important setup step, because a scanner that doesn't know an endpoint is internal will rate it as if the whole internet can reach it.

How severity is rated

Severity is assigned to each finding by how exploitable the bug is in your codebase, not by its category. The same type of bug can be Critical in one app and Medium in another. Here's Anthropic's scale, as of October 2026, with its own examples.

Severity	What it means	Anthropic's example
Critical	Network, anyone, no login or victim action, read and change data	Unauthenticated remote code execution
High	Serious, but needs login/victim action or partial damage	SQL injection behind a login, read and change
Medium	Limited impact, one realistic precondition	SQL injection behind a login, few non-sensitive fields
Low	Limited impact, login or proximity plus special conditions	Timing side channel needing thousands of requests

The categories it looks for cover injection (SQL, command, code, XSS, XXE and ReDoS), path and network issues (path traversal, SSRF and open redirect), auth and access (auth bypass, privilege escalation, IDOR, CSRF and race conditions), memory safety, cryptography, deserialization, and protocol or encoding problems.

What each finding tells you

A finding isn't a one-line alert. Each one records a title, the severity, the category (with a CWE ID where one applies), the file and line range, its status, the assignee, what Claude found, how to fix it, evidence with the branch and commit scanned, how the attack works, why Claude believes it, and the history.

When a finding is resolved it shows one of three outcomes: Marked fixed, Fixed by a merged pull request, or Dismissed. Dismissals carry a reason, either false positive, accepted risk, duplicate or other, which gives a security lead an audit trail rather than a pile of closed tickets.

Scan timing, and why two scans can disagree

The baseline scan can take several minutes or several hours, depending on how big the repository is. You don't have to sit and watch it. Leave the page, and if email notifications are on you'll get an email when a scan finishes with new findings. After the baseline, Claude checks for new commits regularly based on risk and complexity, and there's no fixed schedule.

Here's the part that surprises engineers used to traditional scanners. Anthropic says scans are stochastic by design, so two scans of the same code can return different results. An agent adapts its analysis to each run rather than applying fixed pattern matches. That's a strength for finding new things and a weakness if you expect identical reports for compliance. For a large repository or a monorepo, set a folder scope and exclude the folders you don't need, so each run spends its effort where it counts.

Access, integrations and the limits to know

• Roles. Each project is shared with a Full, Triage or View role, and admins control who can create projects and who can view, triage or manage all of them with RBAC.
• API and MCP. Findings can be read and resolved through the Claude Security API or the Claude Security connector (MCP).
• Webhook. A webhook fires whenever a new finding is added, so you can route it into your own tracker.
• No Zero Data Retention. Claude Security doesn't support ZDR, and Anthropic may retain data where the law requires it or to address Usage Policy violations.
• Migration gaps. Migrating an old project copies the findings to a new one and archives the original, but members, webhooks, excluded directories, scan history and scheduled scans don't come across. GitHub Enterprise projects can't be migrated.

The ZDR point is the one I'd raise with legal before anything else. If your company only uses AI tools under a zero retention agreement, this feature sits outside it.

How to set it up

1. Owner turns on Claude Security in Organization settings and confirms Enterprise premium seats and usage credits.
2. Install the Claude GitHub App (or supply a repo address and token for other Git hosts).
3. Create a project and connect up to eight repositories, marking each in scope or context only.
4. Let the baseline Deep Scan finish and review the threat model it wrote.
5. Triage findings, send the real ones into a Claude Code session for a patch, and track them to Resolved.

If claude.ai/security keeps sending you back to Install GitHub App, Anthropic's checklist is short: check that a GitHub account is connected under Customize > Connectors, that the account belongs to the GitHub organisation where the app is installed, that SSO is authorised for that organisation, and that an IP allow list isn't blocking the per-user check. Anthropic's guide lists the ranges to add.

My verdict on Claude Security

I'd switch it on if you're already on Enterprise, you can't afford a full-time security reviewer for every repo, and you're happy to pay for usage credits. The threat model, the cross-repo tracing and the fix-in-Claude-Code loop are the parts worth having. I'd skip it, or wait, if you need zero data retention, if you've got more than eight closely linked repos that must be scanned together, or if your auditors expect the same scan to give the same answer every time. And if your team mainly wants Claude for writing code rather than checking it, the Claude Code plan breakdown is the better place to start.

Frequently asked questions

Is Claude Security available on Claude Pro or Max?

No. As of October 2026 it's a public beta for Enterprise plans only, and each user needs a premium seat with usage credits enabled.

How many repositories can Claude Security scan?

A project holds up to eight repositories, and both in-scope and context-only repositories count toward that limit.

Why did two Claude Security scans give different results?

Anthropic says scans are stochastic by design, because an agent adapts its analysis to each run instead of applying fixed pattern matches.

Does Claude Security support Zero Data Retention?

No. Claude Security doesn't support ZDR, and Anthropic may retain data where required by law or to address Usage Policy violations.