Claude Code Security Review: /security-review, the GitHub Action, and Is It Safe?

"Claude Code security" means two different things, and people search for both. One is using Claude Code to find vulnerabilities in your code. The other is asking whether Claude Code itself is safe to let loose on your machine.

Here's the short answer to each:

• Claude Code security review comes in two built-in forms: the /security-review command for an on-demand check in your terminal, and the open-source anthropics/claude-code-security-review GitHub Action that comments on pull requests.
• Is Claude Code safe? It's built around a permission system, an optional OS-level sandbox for shell commands, and prompt-injection safeguards. Anthropic is also clear that you're responsible for reviewing what you approve, and that no system is immune to every attack.

This guide covers how each review tool works, how to set up the Action, the newer security tools layered on top, and how Claude Code's own security model holds up.

The /security-review command

Anthropic introduced automated security reviews in August 2025 with two pieces: a /security-review command and a GitHub Action. The command is the one you'll use most, because there's nothing to install.

Open Claude Code in your project and type:

/security-review

Per the commands reference, it reviews the diff between your current branch and origin's default branch. It doesn't scan your whole repository. That has two practical consequences:

• You need an origin remote. Without one, the review can fail with an ambiguous argument error.
• Run it before you commit or open a PR, while the changes are still yours to fix. That's when Anthropic's own guidance says it's most useful.

What it checks for

Anthropic's help center article lists the vulnerability patterns both the command and the Action look for:

Each finding comes with an explanation. Then you can ask Claude to implement the fix in the same session, which keeps the whole loop inside your normal workflow.

Customizing the command

The default prompt works for most projects, but you can change it. The GitHub repo says to copy its security-review.md file into your project's .claude/commands/ folder, then edit it. A common change is adding your organization's own rules to the false-positive filtering instructions, so the review stops flagging things your team has already decided are acceptable.

The Claude Code security review GitHub Action

The command runs when you remember to run it. The Action runs on every pull request, so the review happens whether anyone remembers or not.

According to the repo's README, it:

• Scans only the changed files in a pull request
• Posts findings as review comments on the specific lines of code
• Filters likely false positives to cut noise
• Works with any programming language

Setting it up

Add a workflow file at .github/workflows/security.yml. This is the Quick Start from the repo:

name: Security Review

permissions:
  pull-requests: write
  contents: read

on:
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 2

      - uses: anthropics/claude-code-security-review@main
        with:
          comment-pr: true
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

The only required input is claude-api-key. The README notes the key must be enabled for both the Claude API and Claude Code usage. Store it as a repository secret, never in the file.

The inputs you're most likely to touch:

The Action also outputs findings-count, so a later step can fail the build or notify someone when it's above zero.

The warning you shouldn't skip

The README says it plainly: the Action is not hardened against prompt injection and should only review trusted PRs. A pull request from a stranger could contain text written to steer the reviewer.

The fix is a GitHub setting. Turn on Require approval for all external contributors in your repository's Actions settings, so workflows on outside PRs only run after a maintainer has looked at them.

What the Action filters out

To keep comments focused on high-impact issues, the Action excludes some categories by default: denial-of-service findings, rate-limiting concerns, memory or CPU exhaustion, generic input validation without proven impact, and open redirects. If any of those matter for your project, tune the filtering instructions.

If you already run Claude in CI for other jobs, our Claude Code GitHub Actions guide covers the general-purpose action. The security review Action is a separate, focused tool.

Who can use Claude Code security review

The help center article says both features are available for all Claude Code users, naming users on individual Pro or Max plans and individuals or enterprises with pay-as-you-go API Console accounts.

For the command, keep Claude Code current. It updates itself automatically, and claude update forces it.

Anthropic also frames these tools modestly. The same article says automated reviews should complement, not replace, your existing security practices and manual code reviews. Treat a clean /security-review as one signal, not a sign-off.

The newer security layers in Claude Code

Since the original launch, the Claude Code docs have added more tools, each covering a different stage:

The split that matters: /security-review only looks at your branch's changes. To audit code that already exists, the docs point to asking Claude to review a specific file or folder, or to the Claude Security plugin for a deeper scan. Every one of these reads source code in your checkout. None of them tests a running site or deployed service.

The docs also say the security guidance plugin doesn't block writes or commits, and the review model can miss issues. For hard enforcement, they suggest pairing it with a hook or a CI check.

Is Claude Code safe? How its own security model works

Now the other half of the question. Anthropic's security page describes several layers.

Permissions decide what runs without asking

Every session has a permission mode. In Manual mode, Claude Code starts read-only and asks before editing files, running tests, or executing commands. In Auto mode, which the docs call the built-in starting mode for interactive terminal and VS Code sessions, a separate classifier model reviews actions and blocks the ones it judges unsafe. Your own allow and deny rules still apply in both.

The rule syntax, settings files, and modes are a topic of their own. Our Claude Code permissions guide walks through them.

The sandbox fences in shell commands

The Bash sandbox is a boundary the operating system enforces around the shell commands Claude runs. It works on macOS, Linux, and WSL2, and it's off by default. Turn it on with /sandbox.

Three defaults surprise people:

• Writes are limited to your working directory, a temp folder, and directories you've added.
• Reads cover most of the machine, including credential files like ~/.ssh, unless you deny them.
• It covers shell commands only. Claude's file tools, MCP servers, and hooks run outside it.

For a single boundary around everything, the docs suggest running the whole Claude Code process in a dev container, a VM, or Anthropic's sandbox runtime.

Prompt injection safeguards

Web-fetching commands like curl and wget aren't auto-approved by default. WebFetch usually passes Claude a summary from a separate model call instead of the raw page. Claude Code shows a trust dialog the first time you open an untrusted folder, and project MCP servers get their own approval prompt. In Manual mode, commands it can't fully analyze trigger a prompt.

MCP servers are a risk area of their own. Anthropic says it reviews directory connectors against listing criteria but doesn't security-audit any MCP server. Our breakdown of MCP security risks covers what to check before you connect one.

Where your credentials and code go

API keys and tokens go in the macOS Keychain when available, or a restricted file on Linux and Windows. Local sessions run on your machine. Cloud sessions run in isolated, Anthropic-managed VMs where GitHub credentials never enter the session VM. If you steer a local session from your phone, see how Claude Code Remote Control keeps execution local.

The honest summary: Claude Code gives you real controls, but several are off or permissive by default. Anthropic's own wording is that you're responsible for reviewing proposed code and commands before approval.

Where Taku fits

Security review, sandboxes, and permission rules all assume you're comfortable configuring a developer tool. Plenty of people who want what Claude Code can do never get past the setup.

Taku is an AI-native desktop workspace where you mirror an AI setup someone already got working, run it, and keep it, without reproducing their environment first. If you're reviewing your own code for vulnerabilities, Claude Code is the right tool. Taku is in Beta, and the Mac app is available now.

FAQ

What does Claude Code /security-review do?

It analyzes the changes on your current branch, meaning the diff against origin's default branch, for vulnerabilities like injection, authentication issues, and data exposure. It explains each finding, and you can ask Claude to fix them. It needs an origin remote.

How do I run a Claude Code security review on every pull request?

Add the anthropics/claude-code-security-review GitHub Action to a workflow file, with your Claude API key stored as a repository secret. It reviews the changed files and posts findings as inline PR comments. Only use it on trusted PRs, since it isn't hardened against prompt injection.

Which plans include Claude Code security review?

Anthropic says /security-review and the GitHub Action are available to all Claude Code users, including individual Pro and Max plans and pay-as-you-go API Console accounts. The Action authenticates with a Claude API key you supply. Code Review for pull requests is a separate tool on Team and Enterprise plans.

Is Claude Code safe to use?

It has a permission system, an optional OS-level sandbox for shell commands, and prompt-injection safeguards. The sandbox is off by default, and Anthropic says you're responsible for reviewing what you approve. Work on untrusted code inside a container or VM.

Can Claude Code security review replace a security audit?

No. Anthropic's help center says automated reviews should complement, not replace, existing security practices and manual reviews. The tools read source code, not running systems, and can miss issues.

What's the difference between /security-review and the Claude Security plugin?

/security-review is a single pass over your branch's changes. The Claude Security plugin runs a multi-agent scan of a whole repository or diff and independently reviews each finding before reporting it.