HeyHomees Lab Notes · No. 4 · Anthropic · Published October 19, 2026
By HeyHomees Newsroom ·
In 30 seconds
- Enroll a project by opening a pull request with a project.yaml and Dockerfile
- The scanner builds the project in an isolated VM, runs a model-generated audit without Internet, and emails findings
- Reports include reproducible steps and proposed patches, and can be encrypted with OpenPGP
What is it?
OSS Scanner is a service by Anthropic that scans critical open-source repositories for security vulnerabilities. Projects enroll by adding a project.yaml (and optionally a Dockerfile and threat_model.md) via a pull request. Findings are emailed to the listed primary_contact and any CCs, with reproducible steps and a proposed patch when available.
How does it work?
The scanner imports the project, builds it in an isolated VM with network access, then moves the VM to a network-less environment for the security audit. The build uses the provided Dockerfile; if the build fails, an error email is sent. After scanning, model-generated reports are emailed; they are not reviewed by a human and therefore have no 90-day disclosure period.
What does it need to run?
Enrolling projects must provide a Dockerfile (either in the repository or alongside project.yaml) and a project.yaml with required fields repo and primary_contact. The validation tools require git, Docker, Python 3 with PyYAML, and for QEMU mode a Linux x86-64 host with QEMU installed.
By the numbers
- Required operating system for QEMU mode: Linux on x86-64
- Required host tools for validation: git, Docker, Python 3 with PyYAML
- Maintenance status: actively maintained
The honest read
The figures show only the operational requirements and the repository’s maintenance status; they do not quantify scanning speed, coverage, or detection accuracy. Anthropic reports that the reports are model-generated and not human-reviewed, and that there is no 90-day disclosure period, which means the effectiveness and timeliness of findings rely on the model’s output rather than independent verification.
What we don't know yet
- Exact detection rates or false-positive rates for the scanner
- How long the scanning process takes for a given project
- Whether the service is free or has usage limits
Sources
- README, GitHub (primary)
Researched and drafted with AI from the sources above; every figure is checked against them by code before it is published, and a line that fails is dropped.