claude-code-security-review - An AI-powered security review GitHub Action using

项目说明

Claude Code Security Re

An AI-powered security review GitHub Action using Claude to analyze code changes for security . This action provides intelligent, context-aware security analysis for pull requests using Anthropic's Claude Code tool for deep semantic security analysis. See our blog post here for more details.

Features

Quick Start

Add this to your repository's .github/workflows/security.yml:

Security Considerations

This action is not hardened against prompt injection attacks and should only be used to review trusted PRs. We recommend configuring your repository to use the "Require approval for all external contributors" option to ensure workflows only run after a maintainer has re the PR.

Configuration Options

Action Inputs

| Input | Description | Default | Required |
|-------|-------------|---------|----------|
| claude-api-key | Anthropic Claude API key for security analysis. <br>*Note*: This API key needs to be enabled for both the Claude API and Claude Code usage. | None | Yes |
| comment-pr | Whether to comment on PRs with findings | true | No |
| upload-results | Whether to upload results as artifacts | true | No |
| exclude-directories | Comma-separated list of directories to exclude from scanning | None | No |
| claude-model | Claude model name to use. Defaults to Opus 4.1. | claude-opus-4-1-20250805 | No |
| claudecode-timeout | Timeout for ClaudeCode analysis in minutes | 20 | No |
| run-e | Run ClaudeCode on every commit (skips cache check). Warning: May increase false positives on PRs with many commits. | false | No |
| false-positis | Path to custom false positi instructions text file | None | No |
| custom-security-scan-instructions | Path to custom security scan instructions text file to append to audit prompt | None | No |

Action Outputs

| Output | Description |
|--------|-------------|
| findings-count | Total number of security findings |
| results-file | Path to the results JSON file |

How It Works

Architecture

Workflow

1. PR Analysis: When a pull request is opened, Claude analyzes the diff to understand what changed
2. Contextual Review: Claude examines the code changes in context, understanding the purpose and potential security implications
3. Finding Generation: Security issues are identified with detailed explanations, se ratings, and remediation guidance
4. False Positi: Ad filtering remo or false positi findings to reduce noise
5. PR Comments: Findings are posted as review comments on the specific lines of code

Security Analysis Capabilities

Types of Detected

False Positi

The tool automatically excludes a of low-impact and false positi findings to focus on high-impact :

The false positi can also be tuned as needed for a gi's security goals.

Benefits O SAST

Installation & Setup

GitHub Actions

Follow the Quick Start guide above. The action handles all dependencies automatically.

Local De

To run the security scanner locally against a specific PR, see the e framework documentation.

<a id="security-re"></a>

Claude Code Integration: /security-review Command

By default, Claude Code ships a /security-review slash command that provides the same security analysis capabilities as the GitHub Action workflow, but integrated directly into your Claude Code de en. To use this, simply run /security-review to perform a comprehensi review of all pending changes.

Customizing the Command

The default /security-review command is designed to work well in most cases, but it can also be customized based on your specific security needs. To do so:

1. Copy the security-review.md file from this repository to your project's .claude/commands/ folder.
2. Edit security-review.md to customize the security analysis. For example, you could add additional organization-specific directions to the false positi instructions.

Custom Scanning Configuration

It is also possible to configure custom scanning and false positi instructions, see the docs/ folder for more details.

Testing

Run the test suite to functionality:

Support

For issues or questions:

License

MIT License - see LICENSE file for details.

项目信息

开发语言：Python

Star 数：6303

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。