Anthropic OSS Scanner: free AI security scans for eligible open-source projects

The offer

Core maintainers aged 18+ can apply to Anthropic OSS Scanner for free periodic AI vulnerability scans of established open-source projects with critical infrastructure or user-security impact. Enroll through the official GitHub repository with a project configuration and build Dockerfile; Anthropic reviews authorization and eligibility case by case, and India is a supported region. Reports are AI-generated without human review, may contain errors and must be kept secure and used only to assess and fix the enrolled project; this is not a free Claude subscription.

Who can claim it

• Lead or core maintainers, or people authorized by the lead maintainer; employer permission is required when applicable.
• Established open-source projects with critical infrastructure or user-security impact; acceptance is case by case.
• New projects and ordinary forks typically do not qualify.
• Participants must be 18+ and comply with supported-region rules; India is listed.

How to claim it

1. Open the official OSS Scanner page and follow its GitHub enrollment link.
2. Prepare projects/<name>/project.yaml with the repository URL and a public security-contact email.
3. Provide a Dockerfile that fetches dependencies and builds the project; optionally add a threat model and an encryption public key.
4. Check the configuration and build using the repository instructions, then submit an enrollment pull request.
5. Wait for Anthropic to verify maintainer authorization and accept the project; findings are emailed to the registered contact.

Good to know

The service is provided at no cost while enrolled. Pause with disabled: true or remove the project through a pull request; Anthropic may change or end the service or enrollment.

This is ongoing free scanning, not a time-limited paid-plan trial. Scan frequency varies. Reports are model-generated, not human-reviewed, and may miss bugs or suggest faulty patches. Reports are confidential and limited to fixing the enrolled project; share only with authorized maintainers. Configuration email addresses are public. Human-validated findings can later enter the separate 90-day disclosure process.