Claude Code Security Review

Claude Code Security Reviewer

An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities. This action provides intelligent, context-aware security analysis for pull requests using Anthropic's Claude Code tool for deep semantic security analysis. See our blog post [here](https://www.anthropic.com/news/automate-security-reviews-with-claude-code) for more details.

Features

• AI-Powered Analysis: Uses Claude's advanced reasoning to detect security vulnerabilities with deep semantic understanding
• Diff-Aware Scanning: For PRs, only analyzes changed files
• PR Comments: Automatically comments on PRs with security findings
• Contextual Understanding: Goes beyond pattern matching to understand code semantics
• Language Agnostic: Works with any programming language
• False Positive Filtering: Advanced filtering to reduce noise and focus on real vulnerabilities

Quick Start

Add this to your repository's `.github/workflows/security.yml`:

name: Security Review

permissions:
  pull-requests: write  # Needed for leaving PR comments
  contents: read

on:
  pull_request:

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 2
      
      - uses: anthropics/claude-code-security-review@main
        with:
          comment-pr: true
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

Security Considerations

...