Harden a service in approved phases, then keep new code checked as you write it

Before you start

Install both: /plugin marketplace add wshobson/agents, then /plugin install security-scanning@claude-code-workflows; and /plugin install security-guidance@claude-plugins-official (Claude Code 2.1.144 or later, Python 3.8 or later). The scans use open-source scanners such as Semgrep or Bandit, which you install in your project. Both are aids, not a replacement for human review or pen-testing. Security Guidance's diff and commit reviews send the changed code to your model endpoint.

The hardening changes code, so keep it apart from your main line.

The command takes a description of what to harden and, optionally, the frameworks to check, such as owasp, soc2, gdpr, or . Phase 1 writes a vulnerability scan, a STRIDE threat model and an architecture review into , then stops at a checkpoint.