Claude Code Security Audit

A layered security-audit workflow for Claude Code: a deep LLM-driven repository audit, continuous guardrails during daily work, deterministic CLI scanners the LLM can't replace, and per-PR review — with the exact commands and the order to run them in.

Before I trust an AI agent with a codebase, how do I find what it — and everyone else — could break first?

No single tool is enough. Reasoning-based audits catch design and logic flaws that pattern scanners miss; deterministic scanners catch CVEs, leaked secrets across Git history, and misconfigurations an LLM will never enumerate reliably. This guide stacks both:

• Deep audit — claude-security (official Anthropic plugin) for a thorough, verifier-checked pass over the whole repo.
• Continuous guardrails — security-guidance and Semgrep Guardian, catching bad patterns as code is written.
• Deterministic scanners — Gitleaks, OSV-Scanner, Trivy for secrets, dependencies, and IaC.
• Per-PR review — /security-review and /code-review max on every branch.

Everything below runs inside Claude Code unless marked as a terminal command. Open the project root first.

Isolation warning. The audit plugins run with the same file and shell permissions as Claude Code, with no separate sandbox. Never point them at an untrusted or suspicious repository without a sandbox/container. This is repeated in context below — it's the one thing not to skip.

---

Contents

• Before you start
• 1. Deep repository audit with claude-security
  • Running the scan
  • The report
  • Suggesting patches
  • Limitations and known issues
• 2. Continuous guardrails
  • security-guidance
  • Semgrep Guardian
  • Aikido and Endor Labs
• 3. Deterministic scanners
  • Gitleaks
  • OSV-Scanner
  • Trivy
• 4. Every PR and branch
  • /security-review
  • /code-review max
• Recommended sequence
• Recommended stack
• Related
• Further reading
• License

---

Before you start

Start from a clean state so the report is tied to a specific revision and fixes are easy to review and roll back:

git status
git add .
git commit -m "checkpoint before security audit"

---

1. Deep repository audit with claude-security

claude-security is the official Anthropic plugin for a deep security audit of a repository. Open the project root in a terminal and start Claude Code:

cd C:\path\to\your\repo
claude

Inside Claude Code:

/plugin marketplace add anthropics/claude-plugins-official
/plugin install claude-security@claude-plugins-official
/reload-plugins
/claude-security

Skip the marketplace add line if the official marketplace is already connected.

Running the scan

After /claude-security a menu appears:

1. Scan codebase — full code audit.
2. Choose Whole repository.
3. Set the highest available effort — for a first audit prefer exhaustive/max.
4. Let the scanner explore the repository, but don't let it change code automatically.

The plugin analyzes architecture, public entry points, authentication/authorization, injection, SSRF, file operations, data leaks, privilege escalation, and other vulnerability classes. On large projects it prioritizes attacker-reachable code first and usually skips generated/vendor files unless the most exhaustive mode is selected.

The report

Results land in a directory like:

CLAUDE-SECURITY-2026.../
├── report.md
├── findings.jsonl
└── revision...

Each candidate issue is re-checked by independent verifier agents to cut down false positives.

Suggesting patches

To generate fixes, run the plugin again:

/claude-security

and choose:

Suggest patches

The plugin writes patch files but does not apply, commit, or push them on its own. That's the point — review each patch by hand before applying it.

Limitations and known issues

• No isolation. The plugin works with the same file and shell permissions as Claude Code, without a separate sandbox. Don't run it on a suspicious or untrusted repository without a sandbox/container.
• Plugin/CLI compatibility (v0.10.0). There are open reports that plugin version 0.10.0 is incompatible with some recent Claude Code versions: a scan may fail with Workflow tool not available. If you see exactly that error, the problem is almost certainly CLI/plugin compatibility, not your repository — update Claude Code and reinstall/update the plugin first.
• Resource usage — it is heavy. Scanning a single source folder is still a multi-agent run: up to ~14 subagents in parallel, each reading and grepping across the source. Expect 100% CPU and 20+ GB of memory while it runs; both drop the moment the panel finishes. Close other heavy work first, and don't launch it on a memory-constrained machine. The setup commands you'll see early on — git ls-files, mkdir, and python … write_scan_meta.py — are the scan sizing itself up (size gauge, report directory, revision stamp), not suspicious activity.
• Python dependency (watch out on Windows). The scan's report scripts need Python. A uv-managed interpreter is not on PATH — where python, the PATH, and the usual install directories will not find it, because uv keeps it outside PATH; reach it with uv run python or locate it with uv python find. If you rely on auto-detection you may install a redundant second Python (e.g. via winget) — harmless but unnecessary. Make sure a discoverable Python exists, or point the tool at the uv-managed one.

---

2. Continuous guardrails

security-guidance

For continuous control rather than one big audit:

/plugin install security-guidance@claude-plugins-official
/reload-plugins

It works continuously:

• warns about insecure patterns during Edit and Write;
• reviews the diff after a task completes;
• can separately check a prospective commit.

So the ideal combination is:

• claude-security — deep periodic audit;
• security-guidance — control during daily development.

For higher recall, enable two parallel LLM reviews.

PowerShell:

$env:SG_DUAL_OR = "on"
claude

Bash:

export SG_DUAL_OR=on
claude

This roughly doubles the cost of the check but can surface more issues. Add project-specific rules in .claude/claude-security-guidance.md.

Semgrep Guardian

The best additional automated layer. Install per Semgrep's current instructions:

/plugin marketplace add semgrep/guardian
/plugin install semgrep@semgrep-marketplace
/reload-plugins

Then ask:

Login to Semgrep

Guardian automatically checks files Claude creates through:

• Semgrep Code;
• Semgrep Supply Chain;
• Semgrep Secrets.

It uses deterministic rules and complements Claude's reasoning-based audit well.

Aikido and Endor Labs

Both are also present in the Claude Code ecosystem:

• Aikido — a single platform for SAST, secrets, and IaC;
• Endor Labs — more focused on dependency and software supply-chain risk.

They make sense for teams already using those cloud platforms. For a local or free workflow, Semgrep plus the CLI scanners below is usually simpler.

---

3. Deterministic scanners

An LLM audit does not replace tools that exhaustively check the full Git history, lock files, CVE databases, and infrastructure configs. Don't skip these.

Gitleaks

Secrets across the whole Git history:

gitleaks git -v

Checks not only the current files but patches throughout Git history — an API key removed from the current version can still live in an old commit.

OSV-Scanner

Vulnerable dependencies:

osv-scanner scan -r .

Checks dependency manifests and lock files against the OSV database.

Trivy

One comprehensive local sweep:

trivy fs --scanners vuln,misconfig,secret .

Checks:

• dependencies and CVEs;
• secrets;
• Dockerfiles;
• Kubernetes;
• Terraform;
• other IaC/misconfiguration issues.

---

4. Every PR and branch

/security-review

Claude Code ships this built in:

/security-review

It reviews the diff of the current branch against the default branch in origin — so a Git remote named origin must exist.

/code-review max

Broader than a plain security review:

/code-review max

Beyond security it can also find:

• logic errors;
• broken edge cases;
• concurrency problems;
• incorrect error handling;
• contract incompatibilities;
• potential regressions.

---

Recommended sequence

1.  Make a clean checkpoint commit
2.  gitleaks git -v
3.  osv-scanner scan -r .
4.  trivy fs --scanners vuln,misconfig,secret .
5.  /claude-security → Scan codebase → Whole repository → max/exhaustive
6.  Verify every finding directly in the code
7.  /claude-security → Suggest patches
8.  Apply patches one at a time, together with regression tests
9.  /code-review max
10. /security-review

Recommended stack

For the strongest result:

claude-security
+ security-guidance
+ Semgrep Guardian
+ Gitleaks
+ OSV-Scanner
+ Trivy
+ ordinary unit/integration security tests

---

Related

Part of a set of agent guides — pick the layer you need:

• Awesome AGENTS.md — the base, tool-agnostic ruleset every agent imports (one AGENTS.md).
• Awesome Agent Skills — portable SKILL.md skills every agent loads: code review, debugging, security and leak audits, code and text cleanup.
• Agent MCP Integrations — MCP servers that connect agents to browsers, cloud, databases, infra, and domain APIs.
• Claude Code Token Optimization — the token-efficiency layer (RTK, LSP, Context7, codebase-memory-mcp, claude-mem, Caveman, Ponytail).
• Claude Code Security Audit — this repo: the layered security-audit workflow.

---

Further reading

• Claude Code documentation — slash commands, skills, plugins.
• anthropics/claude-plugins-official — claude-security, security-guidance.
• Semgrep — Guardian, Code, Supply Chain, Secrets.
• Gitleaks · OSV-Scanner · Trivy

---

License

Released under the MIT license. The tools and plugins referenced here are third-party projects under their own licenses — check each before use.