Security Guidance

Security Guidance provides comprehensive vulnerability detection for code written with Claude Code through a sophisticated three-tier defense system. The first layer employs instant regex-based pattern warnings that catch approximately twenty-five known dangerous patterns the moment Claude writes or edits code, alerting to risks like unsafe YAML loading, insecure pickle deserialization, raw innerHTML assignments, and hardcoded credentials. The second layer activates when Claude completes a turn, sending the code diff to a fast language model that performs security-focused analysis and reports high-severity findings back to Claude before you even see the response, enabling automatic fixes. The third layer triggers during git commits, deploying an agentic reviewer powered by the Claude Agent SDK that reads related files across your codebase to trace data flow and identify multi-file vulnerabilities that simple pattern matching cannot detect, such as authorization bypasses, IDOR issues, and cross-file SSRF chains. Coverage spans common web vulnerability classes including injection attacks, XSS, SSRF, hardcoded secrets, authentication bypasses, unsafe deserialization, and path traversal among others. The system ships enabled by default in the official Claude Code plugin marketplace and requires minimal configuration.