Scan your codebase for vulnerabilities changedclaude-security
Nearest release: v2.1.311, published an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 26 Oct 2026 21:16 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 26 Oct 2026 21:37 UTC.
Upstream edited
Recorded here
Lines+20added
Lines−2removed
From line
2
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits21to this page, all time
### Update the plugin ### Choose a scan effort
The whole hunk
from line 2, old and new numbered
/
from line 2
22
33> Install the Claude Security plugin to scan your codebase for vulnerabilities in a Claude Code session and turn findings into patches you review and apply.
44
5The Claude Security plugin runs a multi-agent vulnerability scan of your codebase inside a Claude Code session. A team of Claude agents maps your architecture, builds a threat model, hunts for vulnerabilities, and independently reviews every finding before writing the report. Use the plugin to scan a whole repository or [only a set of changes](#scan-only-your-changes), such as a branch's diff, a pull request's diff, or a single commit, then turn the findings you choose into patches that you review and apply yourself.
5The Claude Security plugin runs a multi-agent vulnerability scan of your codebase inside a Claude Code session. [By default](#choose-a-scan-effort), when you scan a whole repository, Claude agents map your architecture, build a threat model, hunt for vulnerabilities, and independently review every finding before writing the report.
66
7Use the plugin to scan a whole repository or [only a set of changes](#scan-only-your-changes), such as a branch's diff, a pull request's diff, or a single commit, then turn the findings you choose into patches that you review and apply yourself.
8
79The plugin runs locally in your session, uses [whichever models you have access to in Claude Code](#models-and-providers), and each scan counts toward your [usage](https://code.claude.com/docs/en/costs.md). If you want a managed service that monitors your repositories, or want to run scans on [Claude Mythos](https://platform.claude.com/docs/en/about-claude/models/introducing-claude-fable-5-and-claude-mythos-5), see the [Claude Security](https://claude.com/product/claude-security) product, available on the Enterprise plan.
810
911The plugin is also distinct from the review tools already in Claude Code: the [security guidance plugin](https://code.claude.com/docs/en/security-guidance.md) reviews code as Claude writes it, [`/security-review`](https://code.claude.com/docs/en/commands#all-commands) runs a single pass over your branch, and [Code Review](https://code.claude.com/docs/en/code-review.md) reviews pull requests. For how the layers stack, see [How the plugin fits with other security tools](#how-the-plugin-fits-with-other-security-tools).
from line 49
4749
4850Once the plugin is active, you're ready to [scan and fix your codebase](#scan-and-fix-your-codebase).
4951
52### Update the plugin
53
54To update the plugin yourself, see [Update plugins now](https://code.claude.com/docs/en/plugins/install.md#update-plugins-now). Claude Code also [updates the plugin automatically](https://code.claude.com/docs/en/plugins/install.md#keep-plugins-updated) unless auto-update is turned off.
55
5056### Uninstall the plugin
5157
5258To remove the plugin, uninstall it from the `/plugin` menu, or run `claude plugin uninstall claude-security` in your terminal.
from line 97
9197
9298On a large repository, scan one area at a time instead of the whole tree. Pick one of the focused scopes the plugin offers, such as your API layer or your authentication code, and the run sizes itself to what you pick. The report's coverage section states what was and wasn't examined. Run another scan on a different area anytime.
9399
100### Choose a scan effort
101
102Scan effort sets how deep a scan goes. Your findings go through the same independent verification at `low`, `medium`, and `high`.
103
104* **`low`**: a quick first look. It skips the architecture map and the threat model when you scan your codebase.
105* **`medium`**: the default.
106* **`high`**: what `medium` does, plus more hunting for vulnerabilities in the same code.
107
108Name the scan effort in your request at the Claude Code prompt, such as `/claude-security scan my public API code at high` or `/claude-security scan my branch at high`.
109
110If a scan of a large repository finds less than you expect, choose `high` scan effort, scan a second time, or do both. Each can report findings that one `medium` scan doesn't.
111
94112### Read the scan results
95113
96114Every scan writes its results into a timestamped `CLAUDE-SECURITY-<timestamp>/` directory in your repository:
from line 116
98116* **`CLAUDE-SECURITY-RESULTS.md`**: the report, with each finding's ID, such as `F1`, plus its impact, exploit scenario, severity, confidence, and recommendation
99117* **`CLAUDE-SECURITY-RESULTS.jsonl`**: the same findings in machine-readable form, one JSON object per line
100118* **`CLAUDE-SECURITY-RESULTS.sarif`**: the same findings as a [SARIF 2.1.0](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) log for GitHub code scanning and any other tool that reads the standard. The scan classifies findings under their [CWE](https://cwe.mitre.org/) weakness categories
101* **`CLAUDE-SECURITY-REVISION-<commit>.json`**: the revision stamp, recording which commit was scanned, at what effort, whether uncommitted changes were part of the scanned tree, and how thoroughly the run was verified, so a report is always tied to the code it describes. A scan outside version control stamps `UNVERSIONED` in place of the commit
119* **`CLAUDE-SECURITY-REVISION-<commit>.json`**: the revision stamp, recording which commit was scanned, at what [scan effort](#choose-a-scan-effort), whether uncommitted changes were part of the scanned tree, and how thoroughly the run was verified, so a report is always tied to the code it describes. A scan outside version control stamps `UNVERSIONED` in place of the commit
102120
103121That directory is the only change a scan makes to your checkout, and it carries its own `.gitignore`, so a stray `git add` never sweeps a report into a commit. To keep a report in history for an audit trail, delete that one `.gitignore` file and commit the directory like any other.
104122
No line in this hunk matches that.