>> Fixing the existing backlog only solves half the problem; the other half is cutting the rate at which new vulnerabilities enter the codebase. For that, we recommend scanning at PR time. We built security guidance directly into our development process through a Claude Code plugin, which we’ve released publicly.

This both makes sense and is likely very juicy for their token volume.