Claude Code Security Review: What It Checks and Its Limits

The same kind of review can run on every pull request through Anthropic's GitHub Action. The command reports only issues it is more than 80% confident are exploitable and skips denial-of-service and rate-limit issues. It is a focused second reader, not proof that code is safe. Anthropic says it should complement, not replace, manual code review. The Action is not hardened against prompt injection, so use it only on trusted pull requests.

You have finished a feature quickly. Before you commit, you want one more set of eyes on the diff. Typing /security-review is useful, but only if you understand the question it is designed to answer: did this branch add a concrete, exploitable security problem?

What the security review checks

Anthropic describes the command as a review of “the pending changes on the current branch.” It is not a general audit of the whole repository. The prompt tells Claude to focus only on security implications newly added by the change and not to comment on existing concerns.

The official help page names five common issue groups:

Issues the review checks

The check names come from Anthropic's automated security reviews help page. The examples in the second column explain the terms; they are not a promise that every instance will be found.

Our example (illustrative)

This change matches the table's SQL injection row because request input is joined directly into a database query. It is the kind of concrete data path that can meet the prompt's high-confidence rule.

+ app.get('/account', async (req, res) => {
+  const id = req.query.id;
+  const sql = `SELECT * FROM accounts WHERE id = ${id}`;
+  const rows = await db.query(sql);
+  res.json(rows);
+ });

The safer version keeps the value separate from the query:

app.get('/account', async (req, res) => {
  const id = req.query.id;
  const sql = 'SELECT * FROM accounts WHERE id = ?';
  const rows = await db.query(sql, [id]);
  res.json(rows);
});

The command prompt is deliberately strict about evidence. Its main rule is:

“MINIMIZE FALSE POSITIVES: Only flag issues where you're >80% confident of actual exploitability”

That threshold explains why a clean result is not a clean bill of health. A lower-confidence problem may be omitted, and a real issue outside the changed code is out of scope.

What it skips on purpose

The command prompt excludes denial-of-service vulnerabilities, secrets or sensitive data stored on disk, and rate limiting or resource exhaustion issues. The Action applies a broader noise filter that also leaves out generic input validation without proven impact and open redirects.

Those exclusions make the review easier to act on. They also create a clear boundary: another process still needs to cover secrets, operational abuse, dependency management, runtime behavior and the unchanged parts of the system.

Anthropic's own warning is the right standard: automated review helps identify common vulnerabilities, but it does not replace existing security practices or a person reading the code.

A security review checks what your code does. It does not show what AI engines tell buyers about your product. That second job belongs to a visibility platform.

How to run /security-review

Open Claude Code in the project, finish the change you want reviewed, then enter:

/security-review

Claude reads the pending branch changes and returns the security findings it considers actionable. Read each finding against the surrounding code. If it is valid, ask Claude to implement a fix, then inspect the patch and run your normal tests before committing.

The feature is available to Claude Code users, including people on individual Pro, Max and Ultra plans. Anthropic recommends running it before committing significant changes.

You can adapt the review to your repository. Copy security-review.md from Anthropic's repository into .claude/commands/ in your project, then edit the copy with your threat model or organization-specific rules.

The opening of Anthropic's real command prompt

The lines below are from Anthropic's security-review.md. The repository is released under the MIT License.

description: Complete a security review of the pending changes on the current branch

OBJECTIVE: Perform a security-focused code review to identify HIGH-CONFIDENCE security vulnerabilities that could have real exploitation potential.

MINIMIZE FALSE POSITIVES: Only flag issues where you're >80% confident of actual exploitability
AVOID NOISE: Skip theoretical issues, style concerns, or low-impact findings
FOCUS ON IMPACT: Prioritize vulnerabilities that could lead to unauthorized access, data breaches, or system compromise
EXCLUSIONS: Do NOT report the following issue types:
Denial of Service (DOS) vulnerabilities, even if they allow service disruption
Secrets or sensitive data stored on disk (these are handled by other processes)
Rate limiting or resource exhaustion issues

Run it on every pull request with the GitHub Action

Anthropic's Action triggers when a pull request opens, reviews the changed files, filters likely false positives and posts inline comments with concerns and recommended fixes. It needs an Anthropic API key enabled for both Claude API and Claude Code use.

This is the Quick Start workflow from the official repository. Store the key as the repository secret named in the example. The code is reproduced under the repository's MIT License.

name: Security Review

permissions:
  pull-requests: write  # Needed for leaving PR comments
  contents: read

on:
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 2

      - uses: anthropics/claude-code-security-review@main
        with:
          comment-pr: true
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

For pull requests, the Action analyzes changed files rather than treating the run as a whole-repository security assessment. Anthropic recommends enabling it on repositories that contain production code.

The prompt-injection warning

Anthropic's warning, word for word

“This action is not hardened against prompt injection attacks and should only be used to review trusted PRs. We recommend configuring your repository to use the ‘Require approval for all external contributors’ option to ensure workflows only run after a maintainer has reviewed the PR.”

Source: anthropics/claude-code-security-review, read 3 November 2026.

A pull request contains untrusted text and code. The warning means an outside contribution can try to influence the model that reviews it. Require a maintainer's approval before the workflow runs on an external contributor's pull request, and do not expose the Action to changes you do not trust.

Anthropic's other security checks, and which to use

/security-review is one checkpoint, not the name for every security feature Anthropic offers. The tools differ in when they run, what they read and who can use them.

Anthropic security checks

The Claude Security plugin is the deeper option. Anthropic says several agents map the architecture, build a threat model, hunt for vulnerabilities and independently review findings before writing the report. A scan may take time, consume significant tokens and requires Claude Code to remain open. Proposed patches are never applied automatically.

The security guidance plugin is earlier and lighter. It checks edits and turn-level changes while Claude works, but none of its layers blocks a write or commit, and its model can miss issues. Its commit layer does not review commits you run from your own shell.

Does it work? Anthropic's own examples

Anthropic says the GitHub Action found a remote code execution vulnerability in an internal tool that could be exploited through DNS rebinding, and the issue was fixed before merge. The company also says the Action flagged an internal credentials proxy as vulnerable to server-side request forgery.

Those are Anthropic's examples, not an independent Xtrusio test. They show the kind of cross-file reasoning the tool is intended to do, but they do not measure its miss rate or prove that it will find the same class of bug in another codebase.

Check the other side of the story

After you secure what the product does, check what AI engines say about it.

Get your free AI visibility check.

Sources

• Anthropic Help Center: Automated security reviews in Claude Code
• Anthropic: Claude Code Security Reviewer repository
• Anthropic: security-review.md command prompt
• Anthropic: Automate security reviews with Claude Code
• Claude Code docs: Catch security issues as Claude writes code
• Claude Code docs: Scan for security vulnerabilities
• Claude Code docs: Code Review
• Claude Code docs: Security

Sources read 3 November 2026.