/security-review: Make Claude Find the Holes Hackers Use Before You Ship
A free check already built into Claude Code: it reads every file you changed, flags the security holes, explains each one in plain words and fixes it when you say yes. How to run it, how to put it on every pull request, a prompt, and the catch
/security-review is a command that ships with Claude Code. You type it before you ship, and Claude reads every change you haven't committed yet, looks for the holes an attacker would use, and tells you what it found, how bad it is and how to fix it. There's nothing to install.
Here's what it catches, how to run it, how to make it run on every pull request, and the catch.
What it catches
- Injection: inputs a stranger can turn into database queries or shell commands (SQL, command, NoSQL injection).
- Logins and permissions: sign-ins that can be skipped, users who can reach other users' data.
- Leaks: passwords, keys and secrets typed into the code, or private data written to logs.
- Code execution: places where outside input can end up running as code (eval, unsafe loading of files).
- Cross-site scripting, weak encryption, risky settings (open CORS, missing security headers) and risky packages.
- It skips the noisy stuff on purpose (denial of service, rate limits, open redirects) so the list stays about real holes.
Free, for your email
Get the full setup steps + the copy-paste setup prompt
The rest of this guide (5 more sections, 1 copy-paste prompt) opens right here. The setup prompt, one paste into Claude that sets it all up, comes by email only. Use your real address.
Unlocks: Step 1: run it before you ship · Step 2: run it on every pull request (optional) · Step 3: make it yours · The catch · Sources
50,000+ follow where these guides come from. No spam, reply “unsubscribe” any time.