The action reviews diffs and can comment on exact lines
Claude Code Security Reviewer runs in GitHub Actions, analyzes pull-request changes, filters the initial findings, writes a JSON result, and optionally posts comments on relevant lines. The prompt covers injection, authorization, secret exposure, cryptography, unsafe deserialization, cross-site scripting, configuration, supply-chain problems, and business logic. Custom instruction files let a team add application-specific rules or change false-positive handling.
The repository is small: 42 files, roughly 7,437 source lines, and a 0.3 MB checkout. Its main Python package contains the audit runner, prompts, JSON parser, API client, finding filter, and evaluation tools. Small code size makes a pin review feasible. It does not reduce the trust placed in the called model, the action definition, transitive GitHub Actions, or the data sent to Anthropic.
A 17-second install still needs two kinds of Claude access
The sample workflow grants read access to repository contents and write access to pull requests, checks out the proposed SHA, and calls the action with a secret. The API key must be enabled for both the Claude API and Claude Code. Defaults include PR comments, result-artifact uploads, a 20-minute Claude Code timeout, and an Opus 4.1 model identifier. Every choice affects permissions, data handling, run time, or cost.
Our sandbox installed 52 Python packages in 17 seconds and used 76 MB. The claudecode/ project built in 6 seconds. Pip-audit found 0 known vulnerabilities in the installed dependencies. The repository had 2 CI workflow files, no Dockerfile, and no tests directory. A small dependency environment is welcome for a security action, but the model call and GitHub workflow remain the larger operational surface.
What happened when we ran it
We cloned commit 0c6a49f into an unprivileged Debian container with 3 CPUs, 8 GB of RAM, Python 3.12, and no secrets. Installation and build both succeeded, taking 23 seconds combined. The checkout occupied 0.3 MB before dependencies and 76 MB after the 52-package install.
The harness found no test script or target, so it skipped tests. The README documents a pytest claudecode -v command, but our measurement rules do not permit substituting an unmeasured test result. The useful conclusion is limited: dependencies resolved, the supplied build step completed, and no test suite outcome was produced in our sandbox. Any deployment review should run the repository's documented tests and an evaluation set of known secure and vulnerable changes.
Pip-audit's 0 known vulnerabilities applies to the installed Python packages at this commit. It does not assess action logic, prompts, GitHub permissions, model behavior, or dependencies installed by other workflow steps. A security tool needs all of those layers reviewed. The absence of a dependency advisory is one clean signal, not a product-level security result.
Untrusted pull requests can instruct the reviewer itself
The README says the action is not hardened against prompt injection and should only review trusted pull requests. Anthropic recommends GitHub's setting that requires approval for all external contributors. This is the deciding boundary. Source code, comments, fixtures, and filenames can contain text aimed at the model. Running a secrets-enabled model action automatically on hostile input gives that input a place inside the review prompt.
Use a maintainer approval gate, keep repository permissions minimal, and avoid exposing unrelated secrets. Posting comments requires pull-requests: write; analysis itself only needs contents read access. The model's finding is untrusted output too. A human should reproduce the data flow or exploit path before blocking a release, and a generated remediation should receive normal review rather than being applied automatically.
Three open reports weaken green-check semantics
Issue 120, opened July 20, 2026, reports that a SHA-less cache restore prefix can load a marker from an earlier commit on the same pull request. Under the default run-every-commit: false, the reporter observed new commits being skipped while the check stayed green. The issue includes a reproduction and points to the action cache keys on main. Until fixed and verified, inspect logs for proof that the current SHA ran.
Issue 123 reports that false-positive filtering was disabled because its API preflight hardcoded a model retired on February 19, 2026. The reporter traced the failure-open path and said valid result JSON hid the warning. Issue 124 reports that claudecode-timeout: 10 did not stop a stalled call around 10 minutes; an outer GitHub timeout ended it around 27 minutes. These reports concern the reviewed commit and deserve direct acceptance tests.
February code with August issues is active discussion, not active delivery
GitHub recorded the last repository push on February 11, 2026. The latest-release endpoint returned no release, so there is no versioned artifact to compare with main. GitHub showed 6,084 stars and 81 open issues and pull requests. Issue and pull-request activity continued through August, including reports about timeout enforcement and an unnecessary GitHub CLI installation step.
That combination is mixed: users are still testing and proposing changes, while the default branch had not moved for more than 6 months. Pinning commit 0c6a49f is reproducible but preserves the cited open behavior. Following @main will pick up future changes without review. For security infrastructure, fork or pin a checked commit and advance it only after the cache, filtering, timeout, and prompt-injection controls pass your own fixtures.
Claude's review belongs beside deterministic scanners
A model can connect code paths that a simple pattern misses and explain a finding in language a developer can act on. It can also overlook a flaw, misunderstand framework guarantees, or accept instructions embedded in the diff. CodeQL and Semgrep provide repeatable query or rule results; OSV-Scanner covers known dependency advisories. Those tools answer different questions and make better hard gates.
Use Claude Code Security Reviewer as an additional opinion on approved changes. The 23-second install-and-build result makes experimentation cheap, while the missing measured tests and open correctness reports argue against authority. Require evidence that each SHA was scanned, cap the whole job, retain results for audit, and make a person responsible for deciding whether a reported vulnerability is real.