# Claude Code Security Guidance Plugin Official [[Claude Code]] plugin that makes Claude review its own code changes for vulnerabilities WHILE it works, and fix findings in the same session. Install once (`/plugin install security-guidance@claude-plugins-official`), then it runs automatically; nothing to invoke. The goal: less insecure code ever reaches a pull request. It reviews at three points, each deeper than the last: 1. **On each file edit** — a deterministic pattern match, no model call, zero cost. Catches known-risky calls: `eval(`, `os.system`, `pickle`, `dangerouslySetInnerHTML`, edits under `.github/workflows/`, and similar. 2. **At the end of each turn** — a background model review of the full git diff the turn produced (including changes from Bash commands and subagents). Catches what string matching can't: authorization bypass, injection, SSRF, weak cryptography. Findings re-prompt Claude, which fixes them as a follow-up. 3. **On each commit or push Claude makes** — a deeper agentic review that reads surrounding code (callers, sanitizers, related files) to decide whether a finding is real before reporting. That context keeps false positives low. The design details I appreciate: - **The reviewer is not the writer.** Model-backed reviews run as a separate Claude call with fresh context and a find-problems-only prompt. No self-grading. - **Nothing blocks.** Findings arrive as instructions, not gates. It's explicitly one layer of defense in depth: `/security-review` for on-demand passes, the Claude Security plugin for deep scans, Code Review on PRs, and your CI scanners all still matter (see [[Claude Code Security Review]]). - **Extensible, additively.** `.claude/claude-security-guidance.md` adds your threat model in plain language for the model-backed reviews; `.claude/security-patterns.yaml` adds custom regex/substring rules to the per-edit check. You can add rules but never suppress built-in ones. Hard enforcement still belongs in hooks or CI. - **Built entirely on [[Claude Code Hooks]]** (SessionStart, UserPromptSubmit, PostToolUse, Stop). The source is a working reference for running a separate model call from a hook and feeding results back into the session. Practical notes: needs CLI 2.1.144+, Python (3.10+ for the agentic review), and a git repo for the diff-based layers. Model-backed reviews use Claude Opus 4.7 by default (override with `SECURITY_REVIEW_MODEL` / `SG_AGENTIC_MODEL`) and count toward usage; commit reviews cap at 20 per rolling hour. Each layer has its own kill switch (`ENABLE_PATTERN_RULES=0`, `ENABLE_STOP_REVIEW=0`, `ENABLE_COMMIT_REVIEW=0`), and `SECURITY_GUIDANCE_DISABLE=1` turns everything off. For cloud sessions or team-wide rollout, declare it in the project's checked-in `.claude/settings.json` (see [[Claude Code Plugins]]). ## References - Docs: https://code.claude.com/docs/en/security-guidance - Plugin source: https://github.com/anthropics/claude-plugins-official/tree/main/plugins/security-guidance ## Related - [[Claude Code]] - [[Claude Code Security Review]] - [[Claude Code Plugins]] - [[Claude Code Hooks]] - [[Claude Code Review]]