Anthropic's own security scanner admits it isn't secure

What it does

This is a GitHub Action that feeds pull request diffs to Anthropic’s Claude Code for security analysis. It comments findings directly on PR lines, covering the usual suspects: injection flaws, auth bugs, hardcoded secrets, crypto mistakes, and business logic errors like race conditions. A second filtering pass strips out low-impact noise such as DoS concerns and generic input validation warnings.

The interesting bit

The README is unusually candid: the action is “not hardened against prompt injection attacks” and should only run on trusted PRs. Anthropic literally recommends requiring maintainer approval for all external contributors before this workflow fires. It’s a security tool that doesn’t trust untrusted input — a refreshing honesty, if an awkward one for a public repo action.

Key highlights

• Diff-aware scanning: only analyzes changed files, not the full codebase
• Language-agnostic — works across any programming language Claude can read
• Configurable false-positive filtering with custom instruction files
• Ships a matching /security-review slash command for local Claude Code use
• Defaults to Claude Opus 4.1 with a 20-minute analysis timeout
• Outputs structured JSON results and PR comment artifacts

Caveats

• Requires a Claude API key enabled for both API and Claude Code usage; not free
• Prompt injection risk means fork PRs are effectively unsupported without manual gatekeeping
• “Lower false positives” claim is aspirational; no benchmark data or comparison studies are provided

Verdict

Worth a look if you already pay for Claude and want semantic security nudges on internal PRs. Skip it if you need hardened, unsupervised scanning on open-source projects with drive-by contributors — the tool itself agrees that’s a bad idea.