/security-review: Make Claude Find the Holes Hackers Use Before You Ship
A free check already built into Claude Code: it reads every file you changed, flags the security holes, explains each one in plain words and fixes it when you say yes. How to run it, how to put it on every pull request, a prompt, and the catch
/security-review is a command that ships with Claude Code. You type it before you ship, and Claude reads every change you haven't committed yet, looks for the holes an attacker would use, and tells you what it found, how bad it is and how to fix it. There's nothing to install.
Here's what it catches, how to run it, how to make it run on every pull request, and the catch.
What it catches
- Injection: inputs a stranger can turn into database queries or shell commands (SQL, command, NoSQL injection).
- Logins and permissions: sign-ins that can be skipped, users who can reach other users' data.
- Leaks: passwords, keys and secrets typed into the code, or private data written to logs.
- Code execution: places where outside input can end up running as code (eval, unsafe loading of files).
- Cross-site scripting, weak encryption, risky settings (open CORS, missing security headers) and risky packages.
- It skips the noisy stuff on purpose (denial of service, rate limits, open redirects) so the list stays about real holes.
Keep reading
Free, for an email.
Unlocks 5 more sections, 1 copy-paste prompt, the document version, and every other guide on the site, for free. Enter your email once to keep reading.
45,000+ follow where these guides come from.No spam. Unsubscribe in one click.