Claude Code Security Reviewer

Use it when

• Pull requests merge without any security review because the team has no dedicated appsec bandwidth
• Traditional SAST floods every PR with pattern-match false positives so developers have learned to ignore the reports

What it solves

Not the fit when

• scanning untrusted external-contributor PRs without repository approval controls
• dependency vulnerability scanning as a replacement for SCA tools
• compliance-grade full-codebase audits
• DoS, rate-limit, memory or CPU exhaustion, generic input-validation, and open-redirect review unless the default filtering is customized
• not hardened against prompt injection; unsafe on untrusted fork PRs without maintainer approval gating
• diff-aware only for PRs; does not audit unchanged legacy code across the whole repository
• deliberately drops DoS, rate-limiting, and resource-exhaustion findings by default

Install

Add the action to .github/workflows/security.yml: uses: anthropics/claude-code-security-review@main with claude-api-key: ${{ secrets.CLAUDE_API_KEY }} (after actions/checkout with fetch-depth: 2)

Invoke

Runs automatically on pull_request events and posts findings as PR review comments on the affected lines; inside Claude Code, run the /security-review slash command to review pending changes

Alternatives

No reviewed alternatives recorded yet.