Security review in Claude Code: step-by-step guide and GitHub Action automation in 2026

The author of the original material describes their experience: “I just ran security-review on my own vibe project, and the team found several real issues in 4 minutes that have already been fixed.” This is the same work that used to take an external consultant a day.

Additional materials on configuring tools are in the Ailoot documentation.

What is /security-review in Claude Code?#

The command works in two modes. Local: run /security-review in the terminal, and Claude reads the repository and produces a report. Server-side: the same engine is installed as a GitHub Action and automatically comments inline on every Pull Request.

Unlike classic SAST scanners (Snyk Code, Semgrep, SonarQube), /security-review does not work from fixed rules. It reads code like a live engineer: it traces data flow, understands what framework you use and where the trust boundaries are, and catches vulnerabilities that a rule does not describe.

This does not mean /security-review replaces an external pentest or live testing in a staging environment. It can automate part of the initial code review, but this article does not measure a fraction of audit coverage. Below, I’ll explain how to run it properly and what Claude will find in your project.

How do you run /security-review in 5 steps?#

Step 1. Update Claude Code. The command works starting with the release dated February 20, 2026.

claude update

If you installed Claude Code through npm, you can also do this:

npm install -g @anthropic-ai/claude-code@latest

Check that /security-review has appeared:

claude /help | grep security

Step 2. Open the project and sign in to Claude Code.

cd ~/projects/my-vibe-project
claude

Step 3. Run the command. Inside Claude Code, simply enter:

/security-review

Claude automatically goes through 3 analysis phases:

1. Repository Context Research - reads the structure and identifies the stack, routes, and database queries.
2. Comparative Analysis - compares the current state with typical vulnerability patterns for this stack.
3. Vulnerability Assessment - lists every suspicion with a confidence level on a scale of 1-10. Only findings with confidence ≥ 8 are included in the report.

Step 4. Read the report. The output format is a markdown table. For each issue, Claude provides:

• File and line number (for example, src/auth/login.ts:42)
• Severity (HIGH / MEDIUM / LOW)
• Category (sql_injection, xss, auth_bypass, insecure_storage)
• Description - what is wrong
• Exploit Scenario - how an attacker could use it
• Recommendation - how to fix it

Step 5. Ask it to apply fixes. After that, you can work with it like a regular agent:

“Apply the HIGH-severity fixes from the report, one at a time, with a PR description.”

Claude will open each file and propose a change; you confirm it. On a real project, I closed 5 findings in 40 minutes instead of the planned 3 hours.

What vulnerabilities does /security-review find?#

The full list of what is included in the analysis by default is described in the official Anthropic documentation:

Additionally, the command covers categories that automated scanners rarely cover:

• Command injection - executing user input in a shell (child_process.exec(userInput))
• Path traversal - loading a file via ../../etc/passwd
• XXE - XML with external entities
• Template injection - SSTI in Jinja/Handlebars/EJS
• NoSQL injection - $ne, $gt operators in MongoDB queries
• Crypto misuse - using MD5, ECB mode, a static IV

Claude gives each finding a severity. The scale is simple:

• HIGH - remote exploitation without authentication, data leak affecting all users
• MEDIUM - exploitation with additional conditions (a session is required / specific input)
• LOW - a potential vector, not critical now, but worth fixing

Useful to know: in the standard configuration, Claude does not report DoS, rate limiting, memory exhaustion, open redirects without proven impact, regex injection / ReDoS, or log spoofing. This is intentional, so you are not flooded with noise. If these classes matter, extend the rules (see the section on false-positive filtering below).

How do you set up a GitHub Action for automatic review?#

Step 1. Get an API key. Go to console.anthropic.com, create an API key, and copy it.

Step 2. Put the key in the repository secrets. In GitHub: Settings → Secrets and variables → Actions → New repository secret. Name it CLAUDE_API_KEY; the value is your key.

Step 3. Create a workflow file. Save it as .github/workflows/security.yml:

name: Security Review

permissions:
  pull-requests: write
  contents: read

on:
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 2

      - uses: anthropics/claude-code-security-review@main
        with:
          comment-pr: true
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

Step 4. Merge the branch into main. The action will start automatically with the next PR.

What the action does:

• Runs on every open / synchronize Pull Request.
• Takes the diff between the PR branch and main.
• Runs the same engine as local /security-review.
• Posts inline comments directly on code lines with a suspicion.
• Duplicates the full report in the Job Summary.

Important details in permissions:

• pull-requests: write - to post inline comments.
• contents: read - to read code. No write. The action does not modify code itself; it only reports.

This set is sufficient for a private repository. For a public repo, you can additionally specify actions: read if you use reusable workflows.

How do you filter false positives and change sensitivity?#

Full table of GitHub Action inputs (source: repository README):

Example of configuring false-positive filtering. Create the file .claude/security/false-positives.md:

# False positive filtering rules for our project

- Any `dangerouslySetInnerHTML` inside `src/lib/email/layout.ts` is safe -
  the HTML is assembled from trusted templates and passes through `sanitize-html`
  at database write time, not at render time.
- Do not report hardcoded test API keys in `__tests__/fixtures/*.ts`.
  All keys start with `sk-test-fake-`.
- SQL concatenation in `src/lib/admin/migrations.ts` is acceptable - the file runs
  only as root, and input data comes from environment variables.

Connect it in the workflow:

- uses: anthropics/claude-code-security-review@main
  with:
    comment-pr: true
    claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
    false-positive-filtering-instructions: .claude/security/false-positives.md

Custom security scan instructions are similar. Create a file with rules that are critical specifically for your project:

# Additional checks for our project

- Any endpoint under `/api/admin/*` must check the administrator role
  through a shared wrapper. Without this wrapper, it is HIGH severity.
- All YooKassa / CloudPayments webhooks must verify the signature before
  parsing the body. Without this, it is HIGH severity.
- Magic-link tokens must be single-use (marked as used after
  the first valid request). Reusable tokens are MEDIUM severity.

This is no longer an Anthropic preset: you are transferring your expertise about the project into rules that Claude applies every time. That is the essence of “methodology over model.”

For more on context methodology for Claude, see the guides “How to configure CLAUDE.md” and “The Second Brain in Claude Code”.

What does Claude NOT catch and why: honest limitations?#

Anthropic clearly lists what is disabled by default and why (source: repository README):

• Denial of Service - too much noise, almost always low impact.
• Rate limiting concerns - handled at the infrastructure level, not in code.
• Memory / CPU exhaustion - same.
• Generic input validation without proven impact - validating every field creates a false-positive volcano.
• Open redirect - often intended behavior.

What code review alone cannot fully verify without runtime or deployment evidence:

• Production server configuration. NGINX headers, CORS policies, TLS settings, listening ports. These need to be checked manually in a staging environment.
• Race conditions. For example, double-spending during simultaneous refund requests. Static analysis can flag suspicious patterns, but concurrent behavior still needs testing.
• Payment business-logic flaws. If your order total is calculated on the client and simply sent to the payment provider, that is HIGH severity, but Claude does not always see this pattern without explicit context about how payment is supposed to work.
• Database-level IDOR. If the query SELECT * FROM orders WHERE id = $1 does not check WHERE user_id = $session.userId, Claude often catches it. But if the check is implemented through ORM middleware and Claude cannot see the full data flow, it may miss it.
• Social engineering / phishing resistance. It has nothing to do with code.

Use /security-review as an initial static review. Follow it with dynamic tests in staging, role and permission checks, relevant SAST checks, and review of the actual deployed configuration. No measured coverage percentage is established here.

Decide the scope and timing of an external assessment from your system’s risks and changes. Neither one command nor a periodic external audit establishes 100% security coverage.

How the author of the original material ran a security review on a vibe project#

What came up. A typical picture for an average vibe project at the “works in production, but has not been reviewed” stage: several suspicions about the auth flow, the logic for processing webhooks from the payment integration, file upload handling, and a couple of specific notes on HTML handling at render time. I am not describing the details publicly; some recommendations have already been applied, and others are still in PR. In this reported project, the initial scan was useful and fast; it does not establish an audit-coverage percentage or a general completion time.

What I discarded as false positives:

• Findings about DoS through regexes in input validation - the real load does not fall on those regexes.
• One finding about a hardcoded API key - it was a test key with an explicit fake- prefix in fixtures.

How long it took. The run itself took 4 minutes. Reviewing the report took 25 minutes. Applying fixes took about an hour with tests. Total: about an hour and a half from “started” to “everything in main.” An external pentest on the same surface takes a calendar week and costs dozens of times more.

Main takeaway. /security-review does not replace an external pentest. It can identify useful code-level findings, as it did in the author’s reported four-minute scan. Review and test the fixes, then check runtime behavior and deployed configuration separately; the scan does not eliminate the project’s security risk.

How do you integrate /security-review into your pre-commit routine?#

The previously shown hook using git_commit, --severity HIGH, and --fail-on-find is not a documented working recipe and must not be used as a security gate. This article supplies no verified local commit-blocking hook. The official GitHub Action shown above provides automated PR findings; do not infer that it blocks commits or merges merely because it comments on a PR.

A full explanation of hooks is in the “Hooks in Claude Code” guide.

An alternative using routines is to create a pre-deploy-check routine that runs /security-review + npm run build + npm run test with one command. Additional materials are in the Ailoot documentation.

If you use MCP servers, you can integrate findings from /security-review with an incident system (Sentry, Linear, Notion) so each HIGH automatically becomes a ticket.

FAQ about /security-review#

How much does one run cost? It depends on the project size. On my 30K lines, one run uses about $0.30-0.50 of API balance. A large enterprise repository with a million lines costs up to $5-8 per run. That is dozens of times cheaper than any SaaS scanner subscription.

How often should I run it locally? At a minimum, before every production release. Also consider it before significant commits and PRs. This article does not provide a verified automatic commit-blocking hook.

Which stacks does it work with? Any that Claude can read. According to the author's observations, these have been checked: Next.js / Node.js, Python (Django, FastAPI), Go, Rust, PHP (Laravel), Ruby on Rails. Quality is lower on very exotic languages (Erlang, Elixir, Clojure), but it will find something.

What should I do if Claude finds the same “vulnerability” every time, even though it is not actually a vulnerability? Add it to false-positive-filtering-instructions with an explanation of “why this is safe.” Claude will stop reporting it in future runs.

Can I run it only on specific files? Locally, yes: simply run /security-review src/lib/auth/*.ts. In the GitHub Action, only the current PR diff is checked, which is usually what “specific files” means.

Sources#

Additional materials are in the Ailoot documentation.