claude-code-security-review

This GitHub Action integrates Claude Code into pull request workflows to perform automated security reviews of code changes. When a PR is opened, the action runs a Python-based audit pipeline that extracts the diff, sends changed files through Claude Code for semantic analysis, filters findings via a separate Claude API call to remove false positives, and posts inline review comments on the affected lines. The tool covers a broad range of vulnerability classes including SQL injection, XSS, hardcoded secrets, insecure deserialization, TOCTOU race conditions, and weak cryptography, and it works across any programming language. Configuration options include a custom false-positive filtering instructions file, a custom scan instructions file, selectable model (defaulting to claude-opus-4-1), and a per-commit execution toggle. A notable caveat in the documentation warns that the action is not hardened against prompt injection and should only run on PRs from trusted contributors. Security teams and DevOps engineers maintaining repositories on GitHub are the primary audience.

Lo que la gente pregunta sobre claude-code-security-review