Overview
Claude Security is a capability built into Claude that scans codebases for security vulnerabilities and suggests targeted patches for human review. It helps teams find and fix issues that traditional methods often miss. Learn more about Claude security.
Claude Security allows you to:
Enable Claude Security
An organization owner can enable Claude Security by going to Organization settings > Claude Security and switching the Turn on for your organization toggle on.
Finding types
Finding falls into these example categories below.
Injection (SQL, Command, Code, XSS): Untrusted input changes query structure or gets executed. E.g., ' OR 1=1--, ; rm -rf /, <script> in a comment.
Injection (XXE, ReDoS): Parsers or regex abused by crafted input. E.g., XML <!ENTITY> reading /etc/passwd.
Path & Network (Path traversal, SSRF, Open redirect): Input controls file paths, request destinations, or redirects. E.g., ../../etc/passwd, fetching http://169.254.169.254/.
Auth & Access (AuthN bypass, PrivEsc, IDOR/BOLA, CSRF, Race): Access checks missing, skippable, or racey. E.g., GET /orders/123 returns someone else's order.
Memory Safety (Buffer/integer overflow, UAF, unsafe misuse): Input writes past bounds, wraps arithmetic, or hits freed memory. Mostly C/C++/Rust unsafe.
Cryptography (Timing leaks, algorithm confusion, weak primitives): Secret-dependent branches, JWT alg=none, or MD5/SHA-1/DES/ECB in security paths.
Deserialization (Arbitrary type instantiation): Untrusted bytes drive object construction — pickle, Java readObject, YAML load. Often equals RCE.
Protocol & Encoding (Cache safety, encoding confusion, length-prefix trust): Layers disagree or trust declared sizes. E.g., cache poisoning via Host header.
Severities
Severity is assigned per finding based on exploitability in your codebase, not the category itself—so the same category can land at different severities in different repos.
Finding structure
Each finding contains the following fields:
Troubleshooting
The security page keeps redirecting to "Install GitHub App"
The claude.ai/security page runs a per-user check against your own connected GitHub account, so this can fail for you even though the organization-wide installation is working for others. There are a few potential causes:
Frequently asked questions
Scope of use: You will only use Claude Security to scan code that you or your company owns and to which you or your company holds all necessary rights to scan. You will not use Claude Security to scan code owned by or licensed from third parties, including but not limited to open source projects or repositories other than those included in your company's codebase(s).
Related Articles