Skip to content
Recaply.
Sign inSubmit a tool

LearnTutorials

Claude CodeTutorialsOpen Claude Code

Scan your codebase for vulnerabilities with Claude Code

Scan your codebase for security vulnerabilities with the Claude Security plugin in Claude Code, then turn findings into patches you review, in 40 minutes.

By Recaply EditorsIntermediate40 min6 stepsUpdated

A hand shines a flashlight on a padlock resting on a small stack of paper sheets

What you need

  1. Step 1: Install the Claude Security plugin

    2 min

    The plugin runs a deep, multi-agent scan inside your own Claude Code session, with no extra key to set up.

    1. In your project folder, run claude.
    2. At the prompt, run the command below.
    3. Pick an install scope on the details screen. If the summary says to, run /reload-plugins.
    Run this in Claude Code
    /plugin install claude-security@claude-plugins-official

    You should see an install summary for claude-security with no error.

    It says the marketplace isn't found?

    Run /plugin marketplace add anthropics/claude-plugins-official, then run the install command again.

  2. Step 2: Run a full scan

    20 min

    A full scan maps your code, builds a threat model and hunts for flaws, then checks every finding before it reports.

    1. Run /claude-security and pick Scan codebase.
    2. Pick the whole repository, or a focused area such as your API or login code. Each option shows its file count and cost.
    3. Confirm the run, and leave Claude Code open until it finishes.

    You should see each stage reported as it starts, then a note that the report is written.

    The menu opens with a Python warning?

    Install Python 3.9 or newer, or put a newer python3 first on your PATH. Then start a new session.

    A scan can take a while and use a lot of tokens. It runs best in auto mode, so its agents don't stop for approval at each step.

  3. Step 3: Read the report

    5 min

    Only findings that pass an independent check reach the report, so the list stays short and worth reading.

    1. Open the new CLAUDE-SECURITY-<timestamp> folder in your repository.
    2. Read CLAUDE-SECURITY-RESULTS.md. Each finding has an ID such as F1, a severity, a confidence level and an exploit scenario.
    3. Start with the most severe findings.

    You should see a report of numbered findings, plus JSONL and SARIF copies of the same list.

    A big repository came back with fewer findings than you expected?

    Scan one area at a time, or ask for more depth, such as /claude-security scan my API code at high. Scans vary, so a second run can find more.

    The folder has its own .gitignore, so the report won't end up in a commit by accident.

  4. Step 4: Turn findings into patches

    5 min

    A second agent reviews each patch and runs your tests when the project has them.

    1. Run /claude-security again and pick Suggest patches.
    2. Choose the findings you want fixed.
    3. Open the report's patches folder and read each F1.patch file and the note beside it.

    You should see one patch file per finding, or a short note on why a safe patch couldn't be written.

    Some findings were skipped?

    The code changed after the scan, so the report no longer matches it. Run a fresh scan, then ask for patches again.

  5. Step 5: Apply patches one at a time

    5 min

    Nothing is applied for you, so each fix gets its own review and test run.

    1. Make a new branch for one finding.
    2. Apply its patch with the command below, using your report folder's name, then run your tests.
    3. Open a pull request for that fix, then repeat for the next finding.
    Run this
    git apply CLAUDE-SECURITY-[TIMESTAMP]/patches/F1.patch

    You should see the fix in your working tree, ready to commit.

    If a patch has no tests behind it, its note says so. Review that one with extra care.

  6. Step 6: Check each branch before you merge

    3 min

    New code brings new risks, and a quick pass on each branch catches them before they ship.

    1. Run /security-review for a single pass over your branch's changes.
    2. For a deeper check, run /claude-security scan my branch.
    3. Fix what it finds, then merge.

    You should see findings for the branch's changes only, or none.

    /security-review fails with an ambiguous argument error?

    Your clone has no origin/HEAD. Run git fetch origin, then git remote set-head origin --auto, and run the review again.

    Anthropic's security review GitHub Action checks every pull request. Use it on trusted pull requests only. It needs an API key: keep it in a repository secret, never in the workflow file.

You get

A verified list of security findings for your codebase, with reviewed patches you apply one pull request at a time

Try next

Install agent skills in Claude Code6 steps · 5 minInstall an agent skill in any AI coding agent6 steps · 5 minConnect an agent to GitHub with DigitalOcean Action Gateway6 steps · 20 min

Did this guide work for you?

Sources

0 of 6Next: Install the Claude Security plugin