claude-code-security-review

What it is

claude-code-security-review is a GitHub Action (used as anthropics/claude-code-security-review@main) that runs Claude against PR diffs for semantic security review. The summary covers what it detects; this documents how to wire it in and the concrete safety configuration the maintainers require.

How it works

The action checks out the PR head, analyzes only changed files (diff-aware), and posts findings as inline review comments with severity ratings and remediation guidance. False-positive filtering is a separate stage: findings_filter.py plus a dedicated claude_api_client.py re-check findings before posting. The filter is tunable per project, not fixed.

Preconditions / Affected

• Requires a CLAUDE_API_KEY repository secret.
• Workflow needs pull-requests: write (to comment) and contents: read.
• Not hardened against prompt injection — a malicious PR can manipulate the analysis. Only run on trusted PRs.

What to do

Add to .github/workflows/security.yml:

name: Security Review
permissions:
  pull-requests: write  # Needed for leaving PR comments
  contents: read
on:
  pull_request:
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 2

      - uses: anthropics/claude-code-security-review@main
        with:
          comment-pr: true
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

Because of the prompt-injection exposure, also enable the repo setting "Require approval for all external contributors" so the workflow only runs after a maintainer reviews the PR — this is the gate that makes the "trusted PRs only" constraint enforceable.

To customize false-positive filtering or scan instructions, copy security-review.md from the repo into your project's .claude/commands/ folder and edit it (e.g. add org-specific filtering directions); see the repo docs/ folder. Run /security-review inside Claude Code for the same analysis on pending local changes.

To validate a local checkout:

cd claude-code-security-review
pytest claudecode -v

Caveats

• The maintainers state plainly it is not hardened against prompt injection; the external-contributor approval gate is a mitigation, not a fix.
• The filter deliberately drops DoS, rate-limiting, memory/CPU exhaustion, generic input validation "without proven impact," and open redirects — if those matter to you, retune the filter or they will be silently suppressed.
• Pinned to @main in the documented example, so behavior can change without a version bump.