anthropics/claude-code-security-review

This repository contains a GitHub Action built by Anthropic that automatically reviews pull requests for security problems using Claude, Anthropic's AI model. When a developer opens a pull request, the action runs Claude against the changed code and posts comments directly on the lines where it finds potential vulnerabilities. The tool focuses on a wide range of security issues: SQL injection, command injection, hardcoded secrets, authentication flaws, weak encryption, cross-site scripting, insecure configuration, and more. Unlike traditional security scanning tools that look for known patterns, this tool uses AI to understand what the code is actually doing in context, which the README says reduces false positives compared to pattern-only approaches. Setting it up requires adding a workflow file to your repository's GitHub Actions configuration and providing an Anthropic API key as a secret. The README includes a short YAML snippet showing exactly what to paste. Configuration options let you choose which Claude model to use, set a timeout, exclude directories from scanning, and provide custom instructions to tune what counts as a finding for your specific project. There is an important security caveat in the README: the action is not hardened against prompt injection, meaning a malicious contributor could potentially craft code or comments designed to manipulate the AI's output. Anthropic recommends configuring your repository to require maintainer approval before running workflows from external contributors. Beyond the GitHub Action, the same security analysis is also available as a slash command inside the Claude Code development tool, where running it locally checks all pending changes before they are even submitted as a pull request. The repository also includes an evaluation framework for testing the scanner against specific pull requests during local development.