Security review with Claude Code: from one diff to the whole repository

What Claude Code does for security review

• Checks each change for injection, missing authorization, exposed data and secrets in code before it merges.
• Scans the whole repository on a schedule and reports findings with evidence, not bare warnings.
• Turns confirmed findings into patches or issues, most severe first.
• Checks a fix again to confirm it closes the hole.

Claude Code features for security review

How to set up Claude Code for security review

1. Connect the tools

   /security-review works in any session with an origin remote. For full scans, install the Claude Security plugin from the official marketplace; it needs Python 3.9 or later and a paid plan or API access.

   # In a Claude Code session: install the scanner
   /plugin install claude-security@claude-plugins-official
   
   # Scan your branch before merging, at high effort
   /claude-security scan my branch at high

2. Write the rules in CLAUDE.md

   Claude Code reads CLAUDE.md at the start of every session, claude -p runs included. Put the job's rules there, or in a skill under .claude/skills/ if they're long. See the CLAUDE.md guide.

   ## Security review rules
   - Review every pull request that touches auth/, billing/ or SQL.
     Look for injection, missing authorization checks, secrets in
     code and data returned to the wrong user.
   - Rate each finding Critical, High, Medium or Low, with the
     file, the line and how it could be exploited.
   - Never run exploits against production or anything we don't
     own. Read the code and test locally.
   - Open fixes as pull requests; never push to main.

3. Run it without the interactive interface

   claude -p runs one task and exits, so cron, CI or another tool can start it. Choose what it may do without asking with --allowedTools or --permission-mode; --output-format json returns the result with its cost.

   # A security pass on the branch from CI or cron
   claude -p "Run /security-review on this branch and list findings by severity" \
     --output-format json > security-review.json

4. Put it on a schedule

   Make it a cloud scheduled task with /schedule (Pro, Max, Ultra, Team and Enterprise), a desktop scheduled task, or /loop while a session stays open. See how to make Claude Code proactive.

Source: Claude Code documentation

Limits and safety

• It reads the code in your checkout, not your running site, so it won't catch a misconfigured server.
• Scans are nondeterministic: two runs can surface different findings. Run them regularly, not once.
• It adds to your scanners and dependency alerts. It doesn't replace them or a penetration test.
• Since Claude Code v2.1.302, claude -p starts in Manual mode: an action that needs approval is denied unless a rule allows it. Allow only the tools the job needs.

Claude Code or Codex for security review?

The rules carry over. Write them once in AGENTS.md and put @AGENTS.md in CLAUDE.md, and both agents read the same file.

Step by step for the other agent: security review with Codex.

Make security review someone's job

Commands run when someone remembers to run them. Crewmark turns your own Claude Code into an AI employee with a role, a goal in numbers, working hours and a heartbeat, so the work happens on schedule and shows up on a board.

1. Start from the role

   The AI software engineer, with these rules in its brief.

2. Put the work on its board

   Add the job as a recurring issue. The employee wakes on its heartbeat, does it and reports in a comment.

3. Related

   For bugs that aren't security issues, see code review.

FAQ