An opt-in vulnerability-finding service for open-source software

This post introduces OSS Scanner, an opt-in vulnerability-finding service for open-source software that leverages Anthropic's strongest models to perform automated security scans. It details the service's ability to generate vulnerability reports with candidate patches without human review, offering a fast-track for open-source projects to identify and address potential security weaknesses. The post highlights the effectiveness of this approach through feedback from projects like PostgreSQL, OpenSSL, and wolfSSL, and discusses the validation process where 88% of critical and high-severity vulnerabilities met the bar for coordinated vulnerability disclosure.