claude-code-security-review
An AI-powered GitHub Action using Claude for semantic security code reviews.
Detect security vulnerabilities in pull requests using Claude's deep semantic understanding.
This GitHub Action runs Anthropic's Claude Code to analyze pull request diffs for security vulnerabilities. It is built for development teams wanting automated, context-aware security scans directly inside their CI/CD pipelines.
What it is
It parses pull request diffs and passes them to Claude for deep semantic security analysis, checking for injection attacks, authentication flaws, and cryptographic issues. Findings are posted directly as line-specific PR comments, complete with explanations and remediation guidance.
Who it's for
It suits development teams using GitHub Actions who want automated AI security reviews that understand code context beyond static patterns. It is not suitable for teams without a Claude API budget or those merging untrusted fork PRs without strict approval gates.
Key features
Diff-Aware Scanning
Only analyzes changed files in pull requests to keep reviews targeted and fast.
False Positive Filtering
Built-in filtering logic removes low-impact findings like denial of service or rate limiting noise.
Local Slash Command
Includes a `/security-review` command for local development environments via Claude Code.
Custom Scan Instructions
Allows appending custom security audit prompts and filtering rules via text files.
Up and running in 3 steps
Our honest verdict
What's great
- Goes beyond pattern matching to understand code semantics and intent
- Automatically posts findings as precise review comments on specific lines of code
- Includes a local development command mirroring the CI/CD security check
- Language-agnostic support works across any programming language
Where it falls short
- Requires a paid Anthropic Claude API key configured for Claude Code usage
- Not hardened against prompt injection attacks, requiring strict controls on external fork PRs
- Relies on external API availability during your GitHub Actions pipeline execution
Pricing & license
Free under its open source licence, but running it incurs costs based on your Anthropic Claude API usage for every pull request scan.
Open remote AI-training roles
767 open remote AI-training roles, updated November 14, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
What permissions does the GitHub Action require?
It requires pull-requests write permission to leave comments and contents read permission to fetch the code.
Can I filter out false positives?
Yes, the action includes advanced built-in filtering and supports custom false positive instruction files.
Does it work with forks?
It can run on forks, but the README strongly recommends requiring manual approval for external contributor workflows due to prompt injection risks.
