Free Security Scans From Claude's Strongest Model for Your Open-Source Project
Anthropic's OSS Scanner hunts the security holes in your open-source project with its strongest models, proves each bug with a working attack, proposes the patch and emails you the report, free and on a schedule
Security audits are slow and expensive, so most open-source projects never get one. Anthropic, the creators of Claude, now runs one for free: its strongest models scan your project, try to break in, and send you what they found with a proof and a fix. The team has already flagged over 29,000 possible bugs this way.
Here's what you get, how to sign your project up, a prompt to check the reports with Claude, and the catches.
What you get
- A first full scan of your project, then regular scans that look for newly added and previously missed bugs.
- Each finding comes with a proof-of-concept (the attack that shows the bug is real) and a proposed patch where possible.
- Agents double-check each bug, find the root cause and confirm it's in your code, not in a dependency.
- Reports arrive by email to your project's security contact. You can pause or opt out at any time.
Sign your project up
- Check you fit: an open-source license, real users, and code that handles untrusted input (selection is similar to Google's OSS-Fuzz; brand-new projects and most forks don't qualify).
- Fork github.com/anthropics/oss-scanner and copy templates/project.yaml to projects/<your-project>/project.yaml.
- Fill in repo (your GitHub URL) and primary_contact (a security email). Optional: auto_ccs, homepage, threat_model.
- Add a Dockerfile that installs every dependency and builds your project (the scan itself runs offline). Point dockerfile: at it in your repo, or put it next to project.yaml.
- Run tools/validate.py and tools/check <your-project>, then open the pull request. Anthropic reviews and merges it, and the scans start.
Here is a security report for my project: [paste]. Reproduce the proof-of-concept in a test, tell me in plain words if the bug is real, and how bad it is. Review the proposed patch against my code. Does it fix the root cause without breaking anything? Write the test that proves it. Draft a short security advisory for this fix that my users can understand.
Free, for your email
Get the full setup steps + the copy-paste setup prompt
The rest of this guide (2 more sections) opens right here. The setup prompt, one paste into Claude that sets it all up, comes by email only. Use your real address.
50,000+ follow where these guides come from. No spam, unsubscribe in one click.