mrkeyoor.com_
Sat 08 Aug 21:02 UTC
Dev Toolsevaluationupdated 08 Aug 2026

claude-code-security-review

Claude Code Security Review is a GitHub Action that asks Claude to inspect pull-request changes for security flaws and leave line-specific findings. It gives teams a context-aware review alongside conventional scanners, with custom audit instructions and an equivalent `/security-review` command available in Claude Code.

Verdict

Claude Code Security Review is a promising advisory reviewer, especially for business-logic and context-dependent mistakes that rule scanners may miss. It is not ready to be the lone security gate while prompt injection is an acknowledged limitation and open reports question scan freshness and filtering. Use it on trusted code, pin the action, verify every scan, and keep CodeQL, Semgrep, dependency checks, secret scanning, and human review beside it.

Setup3/5Short workflow, but safe triggers and scan verification take care
Docs4/5Clear setup and scope, with critical limitations stated openly
Community3/5Active reports and pull requests, but the main branch has lagged
Maturity2/5No releases and open reports affect confidence in green checks

Who it’s for

  • Teams already using Anthropic's API that want a second set of eyes on trusted pull requests.
  • Maintainers who want security findings, severity, explanations, and remediation notes posted directly on changed lines.
  • Organizations prepared to tune scan and false-positive instructions for their own threat model.
  • Claude Code users who want the same review prompt available locally through /security-review.

Who it’s NOT for

  • Public repositories that automatically run untrusted contributor code: the README explicitly says the action is not hardened against prompt injection and recommends maintainer approval for every external contributor.
  • Teams that need a dependable required merge gate today: an open report says default cache restoration can skip a new commit while the check still appears green.
  • Users relying on the advertised AI false-positive stage: current open reports say its preflight calls a retired hardcoded model and disables the stage without a visible warning.
  • Organizations that cannot send proprietary code context to Anthropic's API or provide a Claude API key enabled for both API and Claude Code use.
  • Teams expecting stable version tags: the repository has no GitHub releases, while the quick start references the mutable main branch.

Setup reality

The mechanical setup is short: add a workflow, grant read access to contents and write access to pull requests, store a Claude API key, and run on an Ubuntu GitHub runner. Safe adoption takes more work than that snippet suggests. External pull requests need an approval policy, the action should be pinned to a reviewed commit rather than main, API spending and a 20-minute default timeout need limits, and teams should test cache behavior plus result artifacts. Until the reported cache and filtering faults are resolved, compare the action logs with the scanned commit and keep established scanners and human review in the required path.

A reviewer, not another pattern matcher

Claude Code Security Review tries to catch bugs that are hard to describe as a simple rule. It runs Claude Code against pull-request changes, asks for security analysis in context, filters findings, and can comment on affected lines. The advertised coverage includes injection, authorization, data exposure, weak cryptography, validation, race conditions, insecure configuration, supply-chain risks, dangerous deserialization, and cross-site scripting.

That breadth is attractive because serious vulnerabilities often depend on intent and data flow. A permission check may exist but protect the wrong object. A safe-looking helper may become dangerous only when called from a new route. Traditional static analysis remains valuable, but an agent reading a diff can raise questions outside a fixed rule set and explain a plausible attack path.

The action is diff-aware. For pull requests it examines changed files, which limits cost compared with repeatedly auditing an entire repository. Custom scan and false-positive instructions let a security team add its own boundaries. Claude Code users get a local counterpart through /security-review, and the supplied command file can be copied into a project for customization.

Installation is short, trust configuration is not

The quick start is a small GitHub Actions workflow. Check out the pull request, call the action, pass an Anthropic API key, and allow it to read repository contents and write pull-request comments. Inputs control artifacts, excluded directories, model, timeout, repeat scans, and custom instructions.

The example uses anthropics/claude-code-security-review@main. That is convenient for a trial but weak for a security workflow because the referenced code can change without review in the consuming repository. An open issue raises this supply-chain concern. A production workflow should reference a full commit SHA that the team has inspected, then update it deliberately. The absence of tagged GitHub releases makes that maintenance less friendly because there is no release line to follow.

The prompt-injection warning changes the audience

Anthropic states plainly that the action is not hardened against prompt injection and should review only trusted pull requests. It recommends approval for all external contributors before their workflows run. Source code, comments, fixtures, and documentation in a pull request can contain instructions intended to manipulate an agent. A security reviewer that follows hostile text may miss a flaw, disclose information available in its environment, or behave unexpectedly.

That makes automatic use on open contribution queues a poor fit. Maintainer approval reduces exposure but does not prove a change is safe. Keep job permissions minimal, avoid making unnecessary secrets available, and treat model output as untrusted advice. The action should not receive deployment credentials, broad repository write access, or authority to merge.

The tool filters out categories it considers noisy, including denial of service, rate limiting, resource exhaustion, generic validation concerns without proven impact, and open redirects. This may improve signal for some web applications, but it can conflict with a team's threat model. Multi-tenant services can care deeply about resource exhaustion. Review and customize those exclusions before judging the default output.

Two current reports undermine gatekeeping use

The most serious open report concerns cache restoration. With run-every-commit disabled by default, a SHA-less restore prefix can reportedly load a marker from an earlier commit in the same pull request. The action then skips the new commit and still appears green. The report includes a root-cause analysis and reproduction. An older issue also describes fixes being skipped and says every-commit scans increase quota use.

Until this is fixed and verified, green status does not prove the current commit was analyzed. Teams should inspect logs for the scanned SHA, consider every-commit runs despite the cost, and avoid making this check sufficient for merging. Scan freshness needs to be visible and machine-verifiable.

Another current report says the false-positive filter's API preflight hardcodes a retired Claude 3.5 Haiku model. According to the report, the request returns 404, filtering disables itself, and the successful result does not surface the degradation prominently. Findings are said to fail open rather than disappear, but the advertised noise-reduction stage is not operating as expected. This can waste attention and makes pipeline state ambiguous.

These are issue reports, not maintainer release notes, but both describe reproducible behavior against current code and remain open. For a security product, silent skips and silent feature degradation justify a conservative maturity score.

Project health and the right role

The repository drew substantial interest and its issue and pull-request queue remained active into August 2026. Contributors proposed hardening, dependency updates, provider support, prompt-injection tests, and fixes. The main repository push date, however, was February 2026, and there are no releases. Current community activity shows demand and investigation, but not a recently shipped upstream resolution to the headline problems. The combined open count includes issues and pull requests, not only confirmed defects.

The documentation is candid and useful. It explains permissions, inputs, architecture, finding classes, exclusions, local evaluation, custom instructions, and the prompt-injection boundary. That honesty helps buyers make the right decision.

Use Claude Code Security Review as an additional opinion on trusted changes. It may find contextual mistakes that deterministic tools overlook, and its explanations can accelerate human review. Do not swap out the rest of the security program. A strong stack combines reproducible static rules, dependency and secret scanning, tests, permission controls, and accountable human judgment, with this action adding one perspective rather than the final word.

Alternatives

ProjectWhat it isPick it when
CodeQL ActionGitHub's workflow actions for database-backed semantic code analysis.pick this instead when you need repeatable, query-driven findings that can serve as a required security check.
SemgrepA fast static analyzer with a large rule ecosystem and custom pattern support.pick this instead when deterministic rules, local execution, and broad CI integration matter more than natural-language reasoning.
GitleaksA focused scanner for secrets in Git repositories, files, and history.pick this instead when preventing credential leaks is the primary goal and you want a narrow, predictable check.

What people are saying

  1. [github-trending] anthropics/claude-code-security-review

Sources

  1. Claude Code Security Review README
  2. Open cache scan-skipping report
  3. Open false-positive filter report
  4. Open action pinning concern
  5. Claude Code Security Review issue activity