Claude Code security review: how to run /security-review

Three ways to run a Claude Code security review

The names overlap, so it helps to separate them by where they run and how much code they read:

The command and the Action came first, announced together by Anthropic in August 2025. Claude Code Security followed in February 2026 and now goes by Claude Security. The rest of this guide takes them in that order, from the cheapest pass to the deepest.

How to run /security-review in Claude Code

1. Put your changes on a branch. The command needs an origin remote, because it compares your branch with origin’s default branch.
2. Type /security-review in a Claude Code session in the repository.
3. Read the report. Each finding gives the file and line, a severity, a category such as sql_injection or xss, an exploit scenario and a recommended fix.
4. Ask Claude to fix what you accept, then run the command again on the updated branch.

Behind the command is a prompt that Anthropic publishes as security-review.md. It loads the git status, the changed files, the commits and the diff, then works in three phases: research the repository’s existing security frameworks and sanitization patterns, compare the new code against them, and trace data from user input to sensitive operations. It examines:

• Input validation: SQL, NoSQL, command, template and XXE injection, and path traversal.
• Authentication and authorization: bypass logic, privilege escalation, session flaws and JWT issues.
• Crypto and secrets: hardcoded keys, weak algorithms, bad randomness and skipped certificate validation.
• Code execution: unsafe deserialization, eval injection and XSS.
• Data exposure: sensitive data in logs, PII handling and debug output.

Anthropic’s published security-review.md prompt tells Claude to report only findings it is more than 80% confident are exploitable, to focus on High and Medium severity, and to comment only on security issues the change introduces. That keeps a Claude Code security review short, and it also means existing weaknesses in untouched code stay out of the report.

How to customize the security review

The built-in command works out of the box, and you can override it per project. The claude-code-security-review repository describes two steps: copy security-review.md into your project’s .claude/commands/ folder, then edit it. Commit the file and everyone on the team gets the same review.

Useful edits are specific to your codebase:

• Name the helpers that make code safe, such as the function that scopes a query to the current tenant or the template filter that escapes output, so Claude checks that new code calls them.
• Add false-positive rules for patterns your team has already accepted, such as an internal admin tool behind a VPN.
• Remove an exclusion that doesn’t fit you. The default prompt skips denial of service, rate limiting, outdated dependencies and test-only files, so a team that wants those covered has to say so.

How to run a security review on every pull request

The anthropics/claude-code-security-review GitHub Action runs the same kind of analysis in CI. On a pull request it reads only the changed files, filters likely false positives and posts each finding as a review comment on the affected lines. The quick start from its README goes in .github/workflows/security.yml:

name: Security Review

permissions:
  pull-requests: write  # Needed for leaving PR comments
  contents: read

on:
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 2

      - uses: anthropics/claude-code-security-review@main
        with:
          comment-pr: true
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

Store an Anthropic API key enabled for both the Claude API and Claude Code as the CLAUDE_API_KEY secret. The inputs worth knowing:

• exclude-directories: a comma-separated list of folders to skip, such as vendored code.
• custom-security-scan-instructions and false-positive-filtering-instructions: paths to text files that add your own checks and filtering rules, the CI equivalent of editing the command.
• claudecode-timeout: minutes before the analysis stops; the default is 20.
• run-every-commit: off by default; turning it on skips the cache check and, per the README, can raise false positives on pull requests with many commits.
• upload-results: on by default, saving findings as a workflow artifact. The Action also outputs findings-count, which a later step can use to fail the job.

Anthropic’s README warns that the claude-code-security-review Action “is not hardened against prompt injection attacks and should only be used to review trusted PRs.” For public repositories it recommends GitHub’s “Require approval for all external contributors” setting, so the workflow runs only after a maintainer has looked at an outside contributor’s pull request.

What Claude Code Security (Claude Security) is

On February 20, 2026, Anthropic announced Claude Code Security, a capability in Claude Code on the web that scans a codebase for vulnerabilities and suggests patches for human review. Instead of matching rules, it reasons about how components interact and how data flows through them. It launched as a limited research preview for Enterprise and Team customers, with free expedited access for open-source maintainers who applied.

The launch post’s headline number came from Anthropic’s own research: its team says it found over 500 vulnerabilities in production open-source codebases, some undetected for decades, and reported them through responsible disclosure. Nothing is applied without human approval; findings and patches wait in a dashboard.

As of November 2026 the product is called Claude Security and is in public beta for Claude Enterprise, turned on by an admin. It runs a baseline scan, keeps scanning new changes, verifies each finding adversarially, lets you edit the threat model and recommends a patch per finding.

Teams outside Enterprise can run a similar scan locally with the Claude Security plugin, installed with /plugin install claude-security@claude-plugins-official. It needs a paid plan, API access or a third-party provider, plus Python 3.9 or later. Run /claude-security to scan the whole repository, one area or a branch’s diff. Separate agents verify every finding before it reaches the report, which is written as Markdown, JSONL and SARIF, and suggested patches land in a patches/ folder for you to apply with git apply.

Anthropic’s Claude Code docs place its security tools in layers: the security guidance plugin while Claude writes code, /security-review for a single pass over a branch, the Claude Security plugin for an on-demand deep scan, Code Review on pull requests for Team and Enterprise, managed Claude Security on Enterprise, and your existing static analysis and dependency scanners in CI.

How it differs from /code-review and Claude Code Review

/security-review looks only for vulnerabilities. /code-review, the general review skill, looks for bugs and for code that breaks your CLAUDE.md conventions, with an effort level and flags to fix findings or post them to the pull request; our guide to the Claude Code review skill covers it.

Claude Code Review is the hosted reviewer for GitHub. It runs on pull request events for Team and Enterprise plans, covers correctness and security, and bills by tokens through usage credits; Anthropic puts the average at $15 to $25 per review. If you want both bug and security findings on every pull request without writing workflows, that is Anthropic’s option for it. See HeyDeer vs Claude Code Review for how the costs compare.

What an AI security review still misses

• Code outside the diff. The command and the Action read the change. A route that was already missing an authorization check stays invisible until someone scans the whole codebase.
• Excluded categories. The default prompt leaves out denial of service, rate limiting, resource exhaustion and outdated dependencies, which Anthropic expects other tools to handle. Keep a dependency scanner in CI.
• Your access rules. Claude can see that a query has no filter, but only your team knows that every invoice belongs to exactly one workspace. Rules like that need to be written down for any reviewer to enforce.
• Runtime behavior. The review reads code without running it, so misconfigured infrastructure and secrets in deployed environments need their own checks.
• Variation between runs. Anthropic notes that two Claude Security scans of the same code can surface different findings, so a clean report is a snapshot, and repeated scans are part of the process.

A short secure code review checklist

A secure code review asks the same questions whether a person or a model does the reading. The OWASP Secure Code Review Cheat Sheet groups them by area. For a pull request, five questions cover most of the risk:

1. Is every external input validated on the server, and are queries parameterized?
2. Does every new endpoint check that this caller may act on this specific record?
3. Are keys, tokens and passwords kept out of code, logs and error messages?
4. Does the change use established libraries for cryptography and randomness?
5. Can a step in the workflow be skipped, repeated or raced through the API?

The full list, with authentication, dependencies and logging, is in the secure section of our code review checklist. Use /security-review to cover the first, third and fourth questions quickly, and spend human attention on the second and fifth, where knowing the product matters most. Apps built mostly by agents need a wider pass; see the vibe coding security checklist.

Where an independent reviewer fits

A security pass in the same Claude Code session that wrote the change shares that session’s assumptions. An independent reviewer reads the pull request separately from the agent that wrote it. HeyDeer reviews every pull request on GitHub, including those opened by coding agents, and labels each finding Critical, High, Medium or Low in one of five categories: Security, Correctness, Reliability, Performance or Maintainability. See how HeyDeer reviews pull requests from coding agents.

Every HeyDeer review already looks for common security issues, so the security rules worth writing down are the ones only your codebase has. Add them as repository checks: Markdown files in .agents/checks/ that list the files they cover and state the requirement. Each matching check gets a reviewer of its own in every pull request that touches those files, so the requirement is verified on each change rather than left to memory.

---
files:
  - "src/api/**/*.ts"
  - "!**/*.test.ts"
---
# API handlers scope queries to the caller's workspace

Every query in an API handler that reads or writes a table with a
`workspace_id` column must filter on the workspace returned by
`requireWorkspace()`. Without that filter, one customer can read
or change another customer's data.

A check like this turns the second question on the checklist into something enforced on every change. A pull request that edits review rules or checks is never approved automatically, and review instructions saved in HeyDeer can’t be changed by a pull request at all. The repository checks docs show how to write and test one.

Sources

1. Claude Code docs: commands (/security-review)
2. anthropics/claude-code-security-review on GitHub
3. Anthropic: Automate security reviews with Claude Code
4. Claude Code docs: scan your codebase for vulnerabilities (Claude Security plugin)
5. Anthropic: Claude Code Security announcement
6. Claude Security product page
7. Claude Code docs: Code Review
8. OWASP Cheat Sheet Series: Secure Code Review