What the tech

Search

Browse topics

/ opens search from anywhere. Esc closes it.

Tools
What the tech
Get the newsletter

security-guidance: a Claude Code plugin by Anthropic

Official

For developers who want Claude's code checked for vulnerabilities as it edits and commits. Skip it if your diffs must never go to a model endpoint.

Copy install command View the source
Score
76of 100
Rank
#16of 25
Updated
2026

Install

/plugin install security-guidance@claude-plugins-official

Type it in Claude Code. View the source

What does security-guidance do?

security-guidance is a Claude Code plugin that installs hooks which review the code Claude writes, in three layers. On every Edit or Write, regex rules warn about around 25 risky patterns, such as yaml.load, pickle.load on untrusted data, raw innerHTML and hardcoded secrets. When Claude finishes a turn, the diff goes to an Opus model and serious findings come back to Claude to fix. On git commit, an agent reads related files to trace data flow and catch problems spread across files, such as IDOR, auth bypass or SSRF. You can add project rules in claude-security-guidance.md and turn layers off with environment variables.

When should you use security-guidance?

Use it when

  • Claude writes code that handles user input or logins
  • You want a security check on every commit
  • Your team has security rules Claude should follow

Skip it when

  • Your code may not be sent to an outside model endpoint
  • You cannot install Python 3.8 or later

What it needs and what it can touch

You need

  • Python 3.8 or later
  • Claude Code 2.1.144 or later
  • A Claude Code sign-in, API key or cloud provider setup for the model reviews

What it can do

  • Runs hooks on file edits, at the end of each turn and on git commit
  • Sends diffs and related file contents to a model endpoint for review
  • Reads project files to trace data flow

From reading its instructions, not from running it.

Why it scores 76

Strongest on upkeep (100 of 100), weakest on adoption (61).

  • Adoption35 points 61
  • Upkeep20 points 100
  • Trust20 points 77
  • Quality15 points We could not read its instructions
  • Reader answers10 points Not enough answers yet, so this does not count

How the formula works

Details

Stars of the shared plugin repository
47,030
Last repository change
License
Not stated
Data confidence
Medium

Alternatives to security-guidance