Claude Code Security remains in research preview—waitlist access only.
This scans your entire codebase hunting for vulnerabilities that traditional pattern matchers miss. It reasons through code flow like a security researcher would. Not just checking for known patterns. Actually tracing how data moves. Understanding context across files. This matters when you're dealing with vulnerabilities that span multiple components or hide in complex interactions.
Before flagging anything, Claude runs what Anthropic calls an adversarial verification pass. It challenges its own findings. Fewer false positives hit your team's queue. When it does surface a vulnerability, you get three things: description, impact analysis, and a suggested patch that matches your existing code style. Every fix requires human approval before it ships.
Security leads dealing with large codebases might appreciate how it scans in parallel. Anthropic uses these same models on its own code. That's their pitch anyway.
Here's the catch—availability. Research preview means joining a waitlist and hoping for access sooner rather than later. You'll need Claude Code too (since this integrates with it). But if your team is tired of wading through false positives from traditional scanners—or missing subtle vulnerabilities that span multiple files—this approach differs enough to warrant attention.
Assuming you can actually get your hands on it.
