Claude Code Security Review: Anthropic's security engineer in your CI

At a glance

The vulnerability classes it hunts: injection (SQL, command, LDAP, XPath, NoSQL, XXE), broken authentication and authorization (privilege escalation, insecure direct object references), data exposure (hardcoded secrets, PII mishandling), cryptographic mistakes, missing input validation, business-logic and race-condition flaws, insecure configuration, unsafe deserialization and code execution, and all three flavors of XSS. Language-agnostic by design.

How it keeps the noise down

Every security team's first question about an AI reviewer is "how much noise?" — and the false-positive filtering is arguably this tool's real feature. After the analysis pass, findings go through a filter that drops the categories that waste reviewer attention:

1. Denial-of-service and resource-exhaustion theories
2. Rate-limiting recommendations
3. Generic "add validation" advice with no demonstrated impact
4. Open-redirect findings and similar low-severity classes

What survives is meant to be worth a human's time, each with a plain-English explanation of the attack path. If your threat model differs — maybe DoS does matter for your service — the filtering instructions are a config option, not a constant.

Installation

For the GitHub Action, add one workflow file and an API key secret:

name: Security Review

permissions:
  pull-requests: write
  contents: read

on:
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 2

      - uses: anthropics/claude-code-security-review@main
        with:
          comment-pr: true
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

For the local command, copy security-review.md from the repo's .claude/commands/ folder into your project's .claude/commands/, then run /security-review in any Claude Code session. Useful Action options include exclude-directories, a model override, and custom false-positive filtering instructions.

Using it day to day

The two forms cover the two moments that matter. The /security-review command is the pre-flight check — run it on your working diff before pushing, fix what it finds while the context is still in your head. The Action is the safety net — it reviews every PR uniformly, including the ones written by coding agents at 2am, and leaves line-level comments a reviewer can act on directly.

One deployment note worth taking seriously: the README is explicit that the tool isn't hardened against prompt injection from adversarial PR content. Run it on trusted contributions — pair it with GitHub's "require approval for all external contributors" setting so workflows never execute on unreviewed third-party code.

Pricing

The tool is free and MIT-licensed; you pay for the Claude API tokens each review consumes, via an Anthropic API key with Claude Code usage enabled stored as a repository secret. For a typical team's PR volume that's coffee money — and materially cheaper than the enterprise SAST seat it partially replaces.

My take

There's a neat symmetry in Anthropic shipping the tool that reviews the code its own models increasingly write — and it's the right shape: uniform coverage, semantic depth, line-level actionability, and an unusually honest stance on its own limits. The false-positive filtering is what makes it deployable; an AI reviewer that cried wolf on every PR would be uninstalled within a week.

Treat it as a strong additional layer, not a replacement for your security program: it reviews diffs, not your whole attack surface, and no reviewer — human or AI — catches everything. But as the default answer to "who security-reviews the AI-generated code?", this is the easiest credible answer to deploy today, and it slots cleanly alongside Spec Kit-style structured workflows as the verification half of the loop.

Frequently asked questions