Scan your code for security bugs before you push

Before you push your code, ask the AI to attack it first.

Run it

/security-review

It looks at everything you changed on this branch compared with the main branch. It does not scan the whole project.

What it hunts for

• Injection problems.
• Login and permission mistakes.
• Data exposure.

If it fails

It needs a git remote called origin. If you see an "ambiguous argument" error, that is usually why.

For plain bugs

/code-review checks the same changes for correctness bugs, and its --fix option applies what it finds.

Honest limits

It is a second pair of eyes, not a guarantee. A clean result does not mean the code is safe. Still test it, still read it, and do not skip a real security review for anything important.

How to act on the findings

1. Start with the most serious finding and make sure you understand the attack it describes before you change anything.
2. Fix it, then ask Claude for a test that would have caught it, so the problem cannot quietly come back.
3. Run /security-review again on the same branch to check the fix did not open a new hole.
4. Write down anything you decided to accept, and why, so the next person knows it was a choice and not a miss.

Where to point it first

Changes that touch login, payments, file uploads, or anything that builds a database query from what a user typed. Those are where the problems it hunts for usually live.

More quick tips

• 4 AI reviewers clean your code at the same time
• Make Claude Code keep going until your tests pass
• All terminal tips and tricks