Anthropic's security review for Claude Code: flags injection, XSS, secrets and more as Claude edits, finishes a turn and commits.
by Anthropic· SecurityUnclaimed · Yours? Claim it
4 images
About
Anthropic's security review plugin for Claude Code. It watches the code Claude writes and checks it in three layers, from instant warnings on each edit to a full review when you commit, and hands what it finds back to Claude to fix. What it checks - Pattern warnings: instant reminders when Claude edits or writes code with one of about 25 known-dangerous patterns, such as yaml.load, pickle.load on untrusted data, raw innerHTML or hardcoded secrets - Diff review: when Claude finishes a turn, the plugin sends the diff to a Claude Opus model and feeds high-severity findings back, so Claude can fix them before you see its response - Commit review: on git commit, an agentic reviewer reads related files to trace data flow across the codebase, catching multi-file problems that patterns miss, such as IDOR, auth bypass and cross-file SSRF Findings cover injection, XSS, SSRF, hardcoded secrets, IDOR, auth bypass, unsafe deserialization, path traversal and more. Make it your own - Add your team's rules in a claude-security-guidance.md file (user-wide in ~/.claude, or per project in .claude/), and the diff review follows them - Choose the review model with SECURITY_REVIEW_MODEL, or turn any layer off with an environment variable - To silence one finding, add a comment on the line saying why it's safe How to install it In Claude Code, run /plugin marketplace add anthropics/claude-code, then /plugin install security-guidance@claude-code-plugins. Anthropic also ships it in its official marketplace, which Claude Code has on by default: /plugin install security-guidance@claude-plugins-official. It needs Claude Code 2.1.144 or later and Python 3.8 or later. Good to know - The diff and commit reviews send the changed code to your model endpoint: Anthropic's API by default, or your gateway or cloud provider. - Anthropic calls it a best-effort aid, not a replacement for human code review, SAST/DAST, dependency scanning or pen-testing. - It keeps a local debug log at ~/.claude/security/log.txt. Nothing in it is uploaded.
Once it’s added
“Add an endpoint that loads user-uploaded YAML settings.”
“Commit these changes.”
“Fix the high-severity findings from the security review.”
“Add a rule to .claude/claude-security-guidance.md: customer queries must go through db.replica.”
“This subprocess call is safe. Add a comment saying why, so the review skips it.”
Before you add it
Reads only
Each edit Claude makes, checked against known-dangerous patterns · The diff of each turn, and related files when you commit · Your claude-security-guidance.md rules
Makes changes · your agent can ask first
Changes no code itself: it hands warnings and findings to Claude to fix · Keeps a local debug log at ~/.claude/security/log.txt
From people who use it
Step by step
Plugins people install alongside Security Guidance.
No reviews yet. Used Security Guidance? Say how it went.
Write a reviewRuns on your machine.
Runs on your machine.
/plugin marketplace add anthropics/claude-code /plugin install security-guidance@claude-code-plugins
Scanned and passed · checked 5 h ago
Nothing new reaches your agent until a person has looked at it.
Scanned on every change, and again when our rules improve.
Claude CodeSupported
OpenClawSupportedTell us and a person on the trust team will look at it. Or email [email protected].
Nobody has shared how they use Security Guidance yet.
Security scan
Passed
Safe to install in every agent it supports. Claude plugins.
Plugins people install alongside Security Guidance.
Equips your coding agent with SAST, dependency scanning, a phased hardening workflow and STRIDE threat-modeling skills.
Alireza Rezvani's Claude Code hook that stops Claude before it writes common security anti-patterns, such as eval, pickle or SQL f-strings.
Microsoft's skills for Azure Data Explorer: build Kusto graphs, compose IRQL threat hunts and turn results into visual graphs.
CrowdStrike's local MCP server for Falcon: your agent triages detections, looks up hosts and threat intel, and runs Next-Gen SIEM searches.
