#88th of 8 in Code review and testing

claude-code-security-review

GitHub Action that has Claude review pull request diffs for security issues

Repository on GitHub ↗

Stars: 6.4k
License: MIT
Last commit: Feb 2026
Language: Python

Stars, last 29 weeks+2,458

3,932 on 25 Mar 20266,390 on 14 Oct 2026

From GitHub's daily star counts.

Checked 15 Oct 2026 on GitHub.

Anthropic is hiring: 646 open roles

Overview

A Python-based GitHub Action that sends pull request diffs to Claude Code and posts security findings as line comments on the PR. A filter step drops categories such as denial of service, rate limiting and open redirects. The README also describes a customizable /security-review slash command in Claude Code.

Who it is for: Teams on GitHub wanting automated AI security review of trusted PRs

Strengths

On PRs it analyzes only changed files and comments on specific lines
Custom scan and false-positive filtering instructions load from text files
Inputs for excluded directories, model name and timeout in minutes
Outputs findings-count and a results JSON file, uploaded as an artifact by default

Weaknesses

README says it is not hardened against prompt injection; use on trusted PRs only
Requires an Anthropic API key enabled for Claude API and Claude Code
Default model is claude-opus-4-1-20250805, which may raise per-run cost
Default filter excludes DoS, rate-limiting and open-redirect findings

What it needs

no GPU
Needs GitHub Actions, Anthropic Claude API key
Models: claude-opus-4-1-20250805 (default), Other Claude models via claude-model input

Also in Code review and testing

See all 8

Also in Code review and testing
Rank	Project	Score
1	open-code-reviewCLI that reviews Git diffs with an LLM agent and line-level comments47.3k starsApache-2.0	79 out of 100
2	no-mistakesLocal git proxy that runs AI review, tests and lint before opening a PR8.9k starsMIT	71 out of 100
3	pr-agentLLM pull request reviewer that comments via /review, /describe and /improve13.4k starsMIT	69 out of 100
#4	e2eAI-driven end-to-end testing framework for web and mobile apps10.7k starsApache-2.0	67 out of 100
#5	front-end-checklistFront-end rules checklist with an MCP server for agent code review74.5k starsMIT	64 out of 100

How to choose

Check where it runs: your CI with your keys, or the vendor's service.
Try it on a real PR; how much noise it makes matters more than its feature list.
See which languages and test frameworks it supports.

Health

Releases: No GitHub releases
Top contributor: 75% of commits3 of 4 in the last 12 months
Security advisories: NoneOn GitHub, in the last 12 months
OpenSSF Scorecard: Not checked

Read from GitHub, deps.dev and OpenSSF on 15 Oct 2026. Bots and coding-agent accounts are left out of the commit counts. Not part of the score: how we check.

License in plain words

MIT Permissive

Use it at work: Yes
Change it and rebrand it: Yes
Sell it or host it for others: Yes

Your part: Keep the copyright and license notice in copies you ship.

A plain summary, not legal advice. Read the license on GitHub ↗ (opens in a new tab)

#8 of 8 in Code review and testing on Archestack, as of 15 Oct 2026.

In your README

The badge updates twice a day.

[![Archestack](https://archestack.com/badge/anthropics/claude-code-security-review.svg)](https://archestack.com/best-of-vibe-coding/projects/claude-code-security-review/)

How badges work

On your site or blog

A card with the rank, score and signals, in light or dark to match the reader.

<iframe src="https://archestack.com/embed/best-of-vibe-coding/claude-code-security-review/" title="claude-code-security-review on Archestack" width="400" height="270" style="border:0;max-width:100%" loading="lazy"></iframe>

Preview the card

Best of Vibe Coding on GitHub

Each review comes from the project's README and facts we check on GitHub. The fix form opens with claude-code-security-review filled in.