VI EN
Claude Code

The security-guidance plugin: Claude reviews its own code for vulnerabilities

Binh 3 min read Đọc bài này bằng tiếng Việt

TL;DR

The security-guidance plugin has Claude review its own code for security issues at three points (each edit, end of turn, commit) and fix them in-session. Add your threat model via a guidance file; it reminds rather than blocks, so you still need Code Review and CI.

AI writes code fast, but it can just as quickly write classic security bugs: SQL injection, eval on user data, unsanitised innerHTML. Waiting for PR review to catch them is late and costly. Anthropic's security-guidance plugin has Claude review the code it just wrote within the session and fix it right away, before it reaches a pull request. Install once, it runs automatically, nothing to remember.

Installation

/plugin install security-guidance@claude-plugins-official

// Enable for the whole team: .claude/settings.json
{ "enabledPlugins": { "security-guidance@claude-plugins-official": true } }

It needs Python 3.7+ (the agentic commit review needs 3.10+) and a git repository. On first run, the plugin creates a virtual environment under ~/.claude/security/.

Three layers of checks

WhenHowCatchesCost
Each file editPattern match, no model calleval(, os.system, pickle, innerHTML =, edits to GitHub workflow filesFree
End of each turnA separate model reviews the git diff in the backgroundAuthorisation bypass, IDOR, injection, SSRF, weak cryptoOne model call per turn that changes files
When Claude commits/pushesAgentic review reading surrounding codeIssues needing broad context, with few false positivesPossibly several model turns per commit

The end-of-turn review covers up to 30 changed files and fires at most three times in a row; commit reviews are capped at 20 per hour. The reviewer is a separate Claude call with a fresh context, not the model that wrote the code grading itself.

Adding your own rules

  • .claude/claude-security-guidance.md: describe your threat model in plain language, e.g. "every /admin route must call require_role("admin") before any database read".
  • .claude/security-patterns.yaml (or .json): add regex or substring patterns to the per-edit check, e.g. warn on the API key prefix sk_live_.

Both are additive: these files can't disable built-in checks.

Where it fits

StageTool
In sessionsecurity-guidance plugin
On demand/security-review on the current branch
Pull requestCode Review (Team/Enterprise plans)
CIYour existing static analysis and dependency scanners

Risks and caveats

  • It reminds, it doesn't block: no layer blocks writes or commits; Claude receives findings as instructions to fix. For hard blocks, use hooks or CI.
  • The model can miss things: treat it as one layer of defence, not a guarantee.
  • Only Claude's commits are reviewed: commits you run from your shell (including the in-session ! escape) aren't.
  • Extra usage: reviews run on Opus by default; change with SECURITY_REVIEW_MODEL and SG_AGENTIC_MODEL.

How to apply it

  • Dev: Install at user scope so every project has it; check ~/.claude/security/log.txt if reviews don't appear.
  • Tech Lead: Write claude-security-guidance.md from real security bugs you've had, and commit it to the repo.
  • PM/Security: Track findings fixed in-session; those are bugs that never reach a PR.

Sources & references

  1. Catch security issues as Claude writes code — Claude Code Docs
More on Claude Code