What Claude Code's Built-In Security Review Actually Catches

Claude Code is one of the more common tools apps on this blog get built with, and Anthropic has added real, meaningful security tooling directly into it: a built-in /security-review command, an open-source GitHub Action version of the same check, and a deeper research-preview capability for enterprise and team customers. Worth walking through what each one actually does.

The /security-review command

Run directly inside Claude Code, this reviews your code for common vulnerability patterns and suggests fixes, right in the same session where the code was written. Having this available as a single command, without needing a separate tool or workflow, lowers the bar for actually running a check meaningfully, especially for builders who wouldn't otherwise think to look for a separate security tool at all.

The GitHub Action version

The same underlying check is also available as an open-source GitHub Action, meaning it can run automatically against every pull request in a repository, rather than depending on someone remembering to run the command manually. That's a meaningfully different guarantee: automatic, repeated coverage instead of a check that only happens when someone thinks to trigger it.

The deeper research-preview capability

Beyond the standard command, Anthropic has a more advanced "Claude Code Security" capability in research preview for Enterprise and Team customers, using AI reasoning to look for less obvious, previously unknown vulnerabilities and suggest patches, rather than just matching against a known list of common patterns. That's a genuinely more ambitious kind of check, still evolving, and worth watching as it moves toward broader availability.

What none of this replaces

• These tools review your code and its patterns. They don't verify your live production database's actual access rules once real data is flowing through it.
• They don't know your specific business logic well enough to catch a workflow-specific mistake unique to your particular app.
• They review what's in your codebase. They don't check what's actually reachable on your live, deployed app from the outside, the way a real visitor would find it.

The honest takeaway for anyone building with Claude Code

Running /security-review, and wiring the GitHub Action in for every pull request, is genuinely worth doing and catches real issues early, in the same place the code is being written. It's a code-level, build-time check. It's a different, earlier layer than checking what your app actually exposes once it's live, which is exactly the layer Harbova's scan was built to sit in alongside it, not instead of it.

Related reading

• Every AI Coding Tool Added Security Checks This Year. Here's What They Still Leave Out.
• Two Things Happened Today. One's Genuinely Useful. One's a Stat I've Told You Not to Trust.
• Claude Code Will Review Its Own Security If You Ask. It Won't Volunteer To.