Every pull request gets a security review

An IT agent that reviews every pull request for security holes with the Claude Code security review GitHub Action, comments on the exact lines with a severity and a fix, filters the noise with the team's own rules, and leaves the merge decision to an engineer

The problem

A small software team ships several pull requests a day and has no security engineer. Code review checks that the feature works, not whether the new endpoint leaks data, and the first time anyone hears about an injection bug is from a customer or an auditor.

How the agent works

1. It starts

   The trigger is a pull request opening in GitHub.

2. The agent works

   The anthropics/claude-code-security-review GitHub Action checks out the branch and runs Claude Code over the changed files only (the README calls this diff aware scanning) with a security prompt that covers injection, broken authentication and authorization, hardcoded secrets and sensitive data logging, weak cryptography, missing validation, race conditions, insecure defaults, vulnerable dependencies, deserialization and XSS. A second filtering pass drops low impact classes the README lists (denial of service, rate limiting, generic input validation without proven impact, open redirects) plus anything the team writes into its own false positive instructions file. Findings land as review comments on the exact lines, each with an explanation, a severity rating and remediation guidance, and the workflow outputs findings-count and a JSON results file. An engineer reads the comments, fixes or dismisses each one, and merges; the action never blocks or approves a merge, so the human review stays the gate.

3. The result

   Developers run the same analysis locally with the /security-review command in Claude Code before they commit, and the README says to switch on GitHub's Require approval for all external contributors setting because the action is not hardened against prompt injection.

Worked example

Anthropic's article of 6 August 2025 gives two cases from its own code: a feature of an internal tool started a local HTTP server meant to accept only local connections, and the action found a remote code execution path through DNS rebinding that was fixed before the pull request merged; an engineer's proxy for managing internal credentials was flagged as vulnerable to server side request forgery and fixed. The GitHub README (MIT licence, 6.5k stars at the time of reading) documents the inputs: default model Opus 4.1 changeable through claude-model, a 20 minute analysis timeout, exclude-directories, and files for custom scan and false positive filtering instructions. The Claude support article of 16 March 2026 says the feature is available to all Claude Code users, on Pro or Max plans and on pay as you go API accounts. No page publishes detection or false positive rates; measure your own by counting comments per pull request that engineers accept versus dismiss.

Sources

• https://github.com/anthropics/claude-code-security-review
• https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code
• https://claude.com/resources/articles/automate-security-reviews-with-claude-code