What Claude Code security review is
Claude Code security review is a built-in command, /security-review, that analyzes the changes on your current branch for security vulnerabilities. It looks at the difference between your branch and your origin remote's default branch, then reports risks such as injection, authentication and authorization problems, and data exposure. You run it on demand, once, when the work is ready. It is not a background scanner and it does not touch your deployed app.
I treat it as the security half of the final check before anything goes to a client. Claude Code code review catches correctness bugs. /security-review asks a different question: if someone hostile used this, what could they get? Those are different reviews, and on client work I want both.
How to run /security-review in the desktop app
- Finish the feature on its own branch. The review compares your branch with the default branch on your origin remote, so the work you want checked needs to be on a branch, not committed straight to main. Use Claude Code with Git covers the branch habit if it is new to you.
- Make sure the project has an origin remote and that you have fetched from it recently. The review needs that remote to know what "before" looks like.
- In the desktop app, type / in the prompt box (or click the + button and choose Slash commands) and pick security-review. You can send it on its own; it already knows to look at the branch diff.
- Read the findings. Each one should name the file, the risk and why it matters. Ask Claude to explain any finding you do not understand in plain words before you touch it.
- Fix what is real, one finding at a time, then run the review again on the updated branch. Stop when it comes back clean or when what remains is a decision you have made on purpose and written down.
The terminal works the same way: type /security-review in a session. The desktop app is just where I run it, because I can keep the findings open next to the diff view and work through them in order.
What it covers, and what it does not
The most common mistake with this command is assuming it reviewed more than it did. It reads the changes on your branch. It does not audit the code that was already on main, it does not test the running site, and it does not check your hosting settings, your database rules or your API key dashboard.
Where /security-review sits among Claude Code's security layers
| Layer | When it runs | What it covers |
|---|---|---|
| Security guidance plugin | Automatically, while Claude writes code | Common vulnerabilities in code Claude is writing, fixed in the same session |
| /security-review | When you ask, once | The changes on your current branch versus origin's default branch |
| Claude Security plugin | When you ask, deep scan | A multi-agent scan of a repository or diff, with reviewed findings and patches |
| Code Review on pull requests | On every PR (Team and Enterprise plans) | Correctness and security review with full codebase context |
| Your CI scanners | On every push | Language-specific rules and dependency checks |
To check code that already exists rather than new changes, ask Claude in a session to review a specific file or folder for vulnerabilities. For anything that is live, the review only ever sees source code in your checkout, so settings that live in a dashboard are still yours to check by hand.
When I run it
- Before merging anything that touches login, sign-up, passwords or user roles. Add authentication with Claude Code covers building those pieces; this is the check after.
- Before shipping any form, upload or search box that takes input from strangers. Input from outside is where injection risks live.
- Before deploying anything that holds a paid API key. A key on the server is not safe if the endpoint around it has no authentication, no rate limit and an open origin policy. Our free guide on keeping API keys safe with Claude Code covers the setup side.
- Before handing a client build over. It goes into the same pre-flight list as reviewing Claude Code output before you ship.
Fixing the "ambiguous argument 'origin/HEAD'" error
If /security-review stops straight away with an error mentioning origin/HEAD and "unknown revision or path not in the working tree", the command could not find your remote's default branch. It builds its context by diffing against a local ref called origin/HEAD, and some setups never create it: single-branch or CI checkouts, a repository with no origin remote, or one you never fetched.
- Run git fetch origin, then git remote set-head origin --auto. That asks the remote which branch is its default and records it.
- If that fails, name the branch yourself: git remote set-head origin main (use your real default branch name).
- If the project has no remote at all, add one with git remote add origin followed by the repository URL, fetch, then set the head.
- Run /security-review again.
You can also just ask Claude in the desktop app to run those commands for you and explain each one. Claude Code permissions explained covers how to approve them without opening the floodgates.
How to act on the findings without breaking the build
Do not paste the whole findings list back and say "fix all of this". That produces one large change that is hard to check. Take the findings one at a time, highest risk first. For each: ask Claude to restate the risk in one sentence, ask what the smallest fix is, apply it, and run the app to confirm nothing else broke. Commit after each fix so you can roll back a single change if needed.
Some findings will be about risk you accepted on purpose, such as an internal tool that only runs on a private network. Write that down in your project notes or CLAUDE.md so the next review and the next person understand the decision. If you are handing the project to a client, the same note belongs in the handover. How to hand off a Claude Code project covers what to include.
Short, practical drops on skills, MCP, agents, prompts, and more. No spam, unsubscribe anytime.
Frequently asked questions
What does /security-review do in Claude Code?
It analyzes the changes on your current branch for security vulnerabilities. It reviews the difference between your branch and your origin remote's default branch and reports risks such as injection, authentication problems and data exposure.
Does /security-review work in the Claude Code desktop app?
Yes. Type / in the prompt box, or click the + button and choose Slash commands, then pick security-review. Built-in commands are available in the desktop app as well as the terminal.
Does Claude Code security review scan my whole codebase?
No. It reviews only the changes on your current branch compared with origin's default branch. To check existing code, ask Claude to review a specific file or folder for vulnerabilities, or use a deeper scanning tool across the repository.
Why does /security-review say ambiguous argument origin/HEAD?
Your clone is missing the origin/HEAD ref that records the remote's default branch. Run git fetch origin and then git remote set-head origin --auto, or name the branch directly with git remote set-head origin main, then run the review again.
Is /security-review enough before shipping client work?
It is a strong filter, not a guarantee. Pair it with a correctness review, test the running app yourself, and check settings that live outside the code, such as hosting, database rules and API key limits.
Last reviewed by David Iya on October 4, 2026
